September 2002 - Test - lists.nanog.org

Just another day on the Internet
by Sean Donelan 10 Sep '02

10 Sep '02

"Experts predicted that Wednesday is likely to be just another day on the Internet, and if anything a quiet day for cybercriminals." http://story.news.yahoo.com/news?tmpl=story&ncid=581&e=7&cid=581&u=/nm/2002… What is a "normal" day on the Internet? http://www.caida.org/outreach/papers/2001/BackScatter/ Measured 12,000 attacks over a three week period, or 570 attacks a day. http://www.fcc.gov/Bureaus/Engineering_Technology/Filings/Network_Outage/ There is a significant outage on average every 2-3 days.

1 0

network stats
by Ian A Finlay 10 Sep '02

10 Sep '02

A while back, I posted a question to this list: http://www.merit.edu/mail.archives/nanog/2002-01/msg00009.html So, I've still been on the lookout for traffic graphs. I know that many times the mrtg graphs can be misleading and downright wrong at many times, but I still think it's neat to be able to see how much traffic is flowing across various links. But, it would be even better to know what the aggregate flow of traffic across the Internet was at any given time. I know it seems impossible to calculate such a measurement... For example, if one looks at exchange point stats, like linx.net, you can see that at any given moment in time, that facility is exchanging ~15 Gb/s. Could one add all of the aggregates of the exchange points together? Would it even make sense to do so? Is CAIDA working on some way to measure aggregate traffic flow on the Internet? Something like the following (except that it would be representative of the entire Internet, not just Abilene) would be really neat. http://monon.uits.iupui.edu/abilene/total/total-bits.html I have done quite a bit of googling, but have not been able to find any relevant information. Regards, Ian

1 0

Re: How do you stop outgoing spam?
by alex＠yuriev.com 10 Sep '02

10 Sep '02

> and bypassing firewalls is an excellent way to get into BIG trouble with > whomever is running the firewall. It is irrelevant how ignorant that > person might be about the traffic which passes through their firewall. > I'm sure if they were only slightly less ignorant they'd run a strict > HTTP gateway on port 80 of their firewall and then you'd be stuck > wrappging everything up to look like proper HTTP in order to bypass > their firewall. It is better that you learn to negotiate the access you > need than to have to resort to using covert channels which could get you > busted. Steno is a great thing, so it wont get anyone busted. Alex

4 4

Re: How do you stop outgoing spam?
by Paul Vixie 10 Sep '02

10 Sep '02

> One of the basic problems with discussions about spam control is that it > focuses entirely on spam. Blocking output SMTP from individual dial-ups > has a serious negative consequence: > > Laptop mobile users cannot use their home SMTP server. in the business, we call this "tough noogies." > At best, they must reconfigure for each venue -- goodbye wireless > hotspot convenience -- and that is IF they know the SMTP server address for > the local access. i've gotten very good mileage out of ssl-smtp, and out of "port forwarding" so that my laptop uses 127.0.0.1:25 for outbound mail, which is actually a (ssh-borne) tunnel to my home smtp server. > In other words, by blocking output SMTP, mobile users are hurt > badly. I know that *I* certainly am. Constantly and serously. yes. let me take this opportunity to thank you for your significant contributions to smtp and of course rfc822. i'm sorry that you have to be hurt now. but the design calls for a polite population, and while that was true of the internet in 1983, it is absolutely not true today. the nonpolite nature of the overall population means that you will have to be hurt and you will have to change how you use mail in order to make the pain stop. there's a slight choice on the pain menu -- you can have (A) an unusable mail system clogged with unwanted traffic such as spam and viruses, or (B) a barely-usable mail system where everything you want to do is less convenient because you have to use ssl-smtp and ssh tunnels. either way you have to be hurt now. and that saddens me, it really does.

1 0

Re: How do you stop outgoing spam?
by Joe St Sauver 10 Sep '02

10 Sep '02

Valdis wrote: #Most spam-fighting efforts on the technical side make the basic assumption #that spam has similar characteristics to a properly designed TCP stack - that #dropped/discarded spam-grams will trigger backoff at the sender. Unfortunately, #discarding a high percentage of the grams will trigger a retransmit multiple #times. Actually, our experience *does* follow the backoff paradigm: if you block a particular source of spam, that rejection *does* seem to trigger "message volume" backoff at the source, with only periodic check probes apparently designed to see if the spam source is really still blocked (and of course it really still is). Now it is true that in many cases the spammer *will* do a set of probes in an effort to see just how broad a given block is (e.g., is it just a /32 that's being blocked? is it my entire netblock? is it a domain based filter? can I slide in via an open SMTP relay or an abusable proxy server?), but at least here at the U of O, we're NOT seeing spammers waste their time attempting delivery of hundreds or thousands of messages per day via hosts that have been identified and filtered. Regards, Joe

3 2

Re: Internet connection secure from surveilance?
by bdragon＠gweep.net 10 Sep '02

10 Sep '02

> Here is my reply to Joe > > Your solution is good. In general, anyone worried about this kind of invasion of privacy > should arrange to run their own root servers. The more the merrier. This is not neccessarily > about having multiple roots with colliding TLDs, but about security from surveillance. A better solution would be to turn off recursion, this _may_ lead to partitioning away from the rest of the internet, just as running a local root may lead to partitioning away. The benefit, of course, is that you don't worry about someone tapping into any sub-domain dns server. Slightly better than that is to disconnect from the network entirely. This will help prevent someone from eavesdropping on other protocols as well. Again, this may lead to partitioning away from the rest of the network.

1 0

Re: How do you stop outgoing spam?
by sal.sabella＠hushmail.com 10 Sep '02

10 Sep '02

Susan, why do your rules not apply to Jane? I realize she's a larger-than-life figure here, but enough is enough. I won my bet with my boss that she would violate AUP at least five (5) times and not get removed from the list. Please read the NANOG FAQ at http://www.nanog.org/aup.html. If there are further hypocrisies on your part, I'll have to ask Brad Knowles for an AOL account to post from. Sal >Please do not post personal messages on the NANOG mailing list, > which >focuses on Internet engineering and operations issues. In my la >st message >to you I pointed to our AUP: > > http://www.nanog.org/aup.html > >If there are further AUP violations on your part, we'll need to > remove >your posting privileges from the list. > >Susan Harris, Ph.D. >Merit Network/Univ. of Mich. > > >On Tue, 10 Sep 2002 sal.sabella(a)hushmail.com wrote: > >> >> >> "Marshall Eubanks" wrote: >> > When I am at a cafe I use a web based encrypted email progr >am, and >> > if I email a large attachment (say a pdf file), then it goe >s http >> > outbound. >> >> When I am at a cafe, I eat, drink, and sometimes converse wit >h others. >> >> > Again, when I go to a cafe in another city, I am generally >there >> > to get some work done >> >> Again, when I go to a cafe in another city, I am generally th >ere to eat, drink, converse, and soak in the local sights. >> >> I might be in Burbank next week on business. We should meet >up then. Think you could get me tickets and a VIP backstage tour at the Tonight Show? I'd like to meet with NBC execs and weigh the pros and cons of multicasting your band's performance in PIM Dense vs. Sparse mode. You're a great musician BTW. Tell Jay I said hi. >> >> Sal Sabella >> >> >> >> >> Get your free encrypted email at https://www.hushmail.com >> > > > Get your free encrypted email at https://www.hushmail.com

1 0

Re: How do you stop outgoing spam?
by sal.sabella＠hushmail.com 10 Sep '02

10 Sep '02

"Marshall Eubanks" wrote: > When I am at a cafe I use a web based encrypted email program, and > if I email a large attachment (say a pdf file), then it goes http > outbound. When I am at a cafe, I eat, drink, and sometimes converse with others. > Again, when I go to a cafe in another city, I am generally there > to get some work done Again, when I go to a cafe in another city, I am generally there to eat, drink, converse, and soak in the local sights. I might be in Burbank next week on business. We should meet up then. Think you could get me tickets and a VIP backstage tour at the Tonight Show? I'd like to meet with NBC execs and weigh the pros and cons of multicasting your band's performance in PIM Dense vs. Sparse mode. You're a great musician BTW. Tell Jay I said hi. Sal Sabella Get your free encrypted email at https://www.hushmail.com

1 0

Deja vu all over again
by sal.sabella＠hushmail.com 10 Sep '02

10 Sep '02

"Pawlukiewicz Jane" wrote: > Quick Question, how much memory does the bgp tables actually take. I'm > estimating 32 mb in my plan, but I'm worried that's not enough. Jane, nothing with you is ever "quick". Rather than just searching google to find the answers to your silly questions, you have to waste all our time. I don't care what bet you have going with your boss, or how many full views you're attempting to cram into that 700 series ISDN router. Repeat after me, Jane: SEARCH FIRST, ASK QUESTIONS LATER. Sal Sabella Get your free encrypted email at https://www.hushmail.com

1 0

VU#210321
by CERT(R) Coordination Center 10 Sep '02

10 Sep '02

-----BEGIN PGP SIGNED MESSAGE----- Hello, The CERT/CC has recently seen discussions in a public forum detailing potential vulnerabilities in several TCP/IP implementations (Linux, OpenBSD, and FreeBSD). We are particularly concerned about these types of vulnerabilities because they have the potential to be exploited even if the target machine has no open ports. The messages can be found here: http://lists.netsys.com/pipermail/full-disclosure/2002-September/001667.html http://lists.netsys.com/pipermail/full-disclosure/2002-September/001668.html http://lists.netsys.com/pipermail/full-disclosure/2002-September/001664.html http://lists.netsys.com/pipermail/full-disclosure/2002-September/001643.html Note that one individual claims two exploits exist in the underground. At this point in time, we do not have any more information, nor have we been able to confirm the existence of these vulnerabilities. We would appreciate any feedback or insight you may have. We will continue to keep an eye out for further discussions regarding this topic. FYI, Ian Ian A. Finlay CERT (R) Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA USA 15213-3890 -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQCVAwUBPX3/VqCVPMXQI2HJAQFEqQQAr54e9c5SGgrIfmK5+EWqSOdvySKRtjwa 6dE4Z4DcoyHS57W5BEwW2OSXSGwrBL+mzippfTEnwAVT/otLYAADsnlPSQioRYNi qHVh8yRXgh3kBgx3cMdhe3NC6zaSWffOsc/EvhkCDo2xa8FQItOqE5MjOeASjt1L st5qq4mgM+E= =kHt1 -----END PGP SIGNATURE-----

2 2