July 2002 - Test - lists.nanog.org

Cisco questions
by Ralph Doncaster 24 Jul '02

24 Jul '02

A couple people pointed out cisco-nsp would be more appropriate for questions like the one I posted about packet loss. http://puck.nether.net/lists/ Ralph Doncaster principal, IStop.com

1 0

packet loss source
by Ralph Doncaster 24 Jul '02

24 Jul '02

Thanks to those who suggested improper duplex negotiation between the 2621 and the 2900. Although "show int" on the 2621 (running 12.0.7T) indicates full-duplex, "sh controller" indicates BCR9 =0x00000000 (half-duplex). Ralph Doncaster principal, IStop.com

1 0

RE: Security of DNSBL spam block systems
by Brad Knowles 24 Jul '02

24 Jul '02

At 2:29 AM -0400 2002/07/23, Phil Rosenthal wrote: > IMHO Even the really large DNSBL's are barely used -- I think > (much) less than 5% of total human mail recipients are behind > a mailserver that uses one... Not true. There are plenty of large sites that use them (e.g., AOL), and many sites use them to help ensure that they themselves don't get added to the black lists. IMO, there is a serious risk of having DNSBL servers attacked and used as a DoS. The easiest way would be to check to see if the servers being used are open public caching recursive servers, in addition to their authoritative services. If so, then they would be open to cache poisoning attacks. That said, I think the bigger black list services are run by people who have at least half a clue as to how a nameserver should be operated, and therefore they should be relatively secure. However, they would still be at risk if one of their parent zones is served by a nameserver that mixes both authoritative service & caching/recursive service, and therefore would be easily subject to cache poisoning. -- Brad Knowles, <brad.knowles(a)skynet.be> "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania.

3 2

New NANOG traceroute (fixes -T compromise)
by Ehud gavron 23 Jul '02

23 Jul '02

The new NANOG traceroute (also known as TrACESroute) is now available. It fixes the latest "security" compromise detailed on Bugtraq and on SUSE security focus at http://online.securityfocus.com/advisories/2740 Ehud Gavron gavron(a)wetwork.net Directory: ftp://ftp.login.com/pub/software/traceroute/beta/ Code: ftp://ftp.login.com/pub/software/traceroute/beta/traceroute.c Directions: ftp://ftp.login.com/pub/software/traceroute/beta/0_readme.txt

1 0

OT: If you thought Y2K was bad, wait until cyber-security hits
by Rowland, Alan D 23 Jul '02

23 Jul '02

(shooting self in foot...) Just eliminate tech support and proprietary software! "A list of our settings is available at www.domain.com/settings. And don't call us with tech problems. We don't do tech support." I know of at least one ISP out there already doing this. Not that they're highly successful, but imagine not having to tell someone, "Yes, your username and password are case sensitive and must be spelled exactly as supplied. And it's .net, not .com" ever again. Or alternately just require registration through a BBS system as a clue test. :) (Waiting for visit from the sales/marketing/shareholder folk...) Best regards, _________________________ Alan Rowland -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Saturday, July 20, 2002 10:03 PM To: Scott Francis Cc: nanog(a)merit.edu Subject: Re: If you thought Y2K was bad, wait until cyber-security hits Snip... I'll personally nominate for sainthood anybody who figures out how to make it work for an ISP's terms of service. ;) -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

21 47

debugging packet loss
by Ralph Doncaster 23 Jul '02

23 Jul '02

I'm seeing 2-5% packet loss going through a Cisco 2621 with <10mbps of traffic running at ~50% CPU. (packet loss based on ping results) Pinging another box on the same catalyst 2900 switch gives no packet loss, so it seems the 2621 is the source of the packet loss. I need help figuring out why it is dropping packets, and how to stop it. The odd thing is that the interface stats don't show any dropped packets: Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 00:01:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 00:10:16 Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 1/512, 0 drops 5 minute input rate 5257000 bits/sec, 1383 packets/sec 5 minute output rate 5692000 bits/sec, 1448 packets/sec 845743 packets input, 392733148 bytes Received 403 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast 0 input packets with dribble condition detected 887446 packets output, 430245866 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 22694 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Ralph Doncaster principal, IStop.com

6 5

Level3 Fiber Cut
by German Martinez 23 Jul '02

23 Jul '02

Somebody affected by a Level3 fiber between Boston and New York ? Thanks German

2 1

password stores?
by Daniska Tomas 23 Jul '02

23 Jul '02

hi, i'm wondering how large isps offering managed cpe services manage their password databases. let's say radius/tacacs is used for normal cpe user aaa, but there is some 'backup' local user account created on the cpe for situations when the radius server is unreachable. for security reasons, this backup account (as well as snmp communities, radius key etc.) is unique per cpe to avoid frauds caused by end-users (even if one does password recovery on the cpe, they still don't have the password for other cpe's). if there are hundreds or thousands of these cpe's that could mean storing of tens thousands of password. are there any crypto-based products available or do the people use their own stuff? thanks -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

2 1

Security of DNSBL spam block systems
by Big_Bandwidth 23 Jul '02

23 Jul '02

What are the security implications of someone hacking a DNSBL (Real-time-spam-block-list) and changing the block list to include (deny email from) some very large portion or all IPv4 space? Given that a signifigant number of the spam blocking lists seem to operate on a shoestring budget in someone's basement, how can we be assured that they have sufficient resources to secure their systems adequatley, and monitor for intrusion 24x7? Unless I am missing something, this would seem to be a real handy and centralized method for someone to interfere substantially with the proper operation of a few thousand email servers and hold up global email traffic for a few hours. -BB

2 1

Nanog traceroute format string exploit. (fwd)
by jeffrey arnold 22 Jul '02

22 Jul '02

This came through on bugtraq this afternoon. -jba __ [jba(a)analogue.net] :: analogue.networks.nyc :: http://analogue.net ---------- Forwarded message ---------- Date: Sun, 21 Jul 2002 14:09:24 +0200 From: SpaceWalker <spacewalker(a)minithins.net> To: bugtraq(a)securityfocus.com Cc: vuln-dev(a)securityfocus.com Subject: Nanog traceroute format string exploit. Hello, As the vulnerability has been published some weeks ago, and no working exploit has been released (the perl exploit was joke) I decided to release my private exploit. I do it only because -This exploit will never be used to haxor something because I never saw this traceroute used by default -This exploit find offsets "by the proper way" and doesn't place the target adresses in the format string. (and is interresting to study for beginners). Have phun, please don't haxor with it. SpaceWalker

1 0