September 2002 - Test - lists.nanog.org

DDoS/Backbone Security presentations
by Nicolas FISCHBACH 26 Sep '02

26 Sep '02

Hi, If it's of any interest, the slides from my SwiNOG-5 presentation on DDoS (attacks, detection, protection, etc) are available: http://www.securite.org/presentations/ddos/ Some "older" slides from BH US'02 on "IP Backbone Security" are also available (PPT'97 and PDF): http://www.securite.org/presentations/secip/ Nico. -- Nicolas FISCHBACH (nico(a)securite.org) <http://www.securite.org/nico/> IP Engineering Manager - COLT Telecom AG Securite.Org Team <http://www.securite.org/>

1 0

Sprint (1239) blackhole ? Or bogus /32 route ?
by Mike Tancsa 26 Sep '02

26 Sep '02

Hi, I am trying to figure out if either sprint (as1239) has blackholed a single IP address in my network or something strange is up. If anyone has transit connectivity to AS1239, can you tell me if Sprint is sending 199.212.134.9/32 as a prefix ?? e.g. from as1239's website looking glass http://oxide.sprintlink.net/cgi-bin/glass.pl (only a traceroute interface) sl-bb20-ana>trace 199.212.134.9 Type escape sequence to abort. Tracing the route to smtp2.sentex.ca (199.212.134.9) 1 * * * Yet, on that same subnet all else is fine sl-bb20-ana>trace 199.212.134.1 Type escape sequence to abort. Tracing the route to ns.sentex.ca (199.212.134.1) 1 sl-bb22-ana-14-0.sprintlink.net (144.232.1.177) 4 msec sl-bb23-fw-10-2.sprintlink.net (144.232.18.241) 24 msec sl-bb22-ana-14-0.sprintlink.net (144.232.1.177) 0 msec 2 sl-bb25-chi-6-0.sprintlink.net (144.232.9.25) 56 msec sl-bb22-fw-10-1.sprintlink.net (144.232.9.250) 24 msec sl-bb25-chi-6-0.sprintlink.net (144.232.9.25) 52 msec 3 sl-bb22-chi-11-0.sprintlink.net (144.232.18.121) 48 msec sl-bb25-chi-15-0.sprintlink.net (144.232.26.82) 52 msec sl-bb22-chi-11-0.sprintlink.net (144.232.18.121) 44 msec 4 sl-gw33-chi-10-0.sprintlink.net (144.232.26.42) 52 msec sl-gw33-chi-9-0.sprintlink.net (144.232.26.22) 60 msec sl-gw33-chi-10-0.sprintlink.net (144.232.26.42) 48 msec 5 sl-splk-telus-1-0.sprintlink.net (144.223.35.30) 48 msec 52 msec 48 msec 6 chcnil23gr01.bb.telus.com (154.11.11.90) [AS 852] 48 msec chcnil23gr01.bb.telus.com (154.11.11.94) [AS 852] 48 msec chcnil23gr01.bb.telus.com (154.11.11.90) [AS 852] 48 msec 7 toroonxnbr00.bb.telus.com (154.11.11.5) [AS 852] 56 msec 64 msec 56 msec 8 toroonzddr00.bb.telus.com (154.11.6.67) [AS 852] 64 msec 56 msec 64 msec 9 peer.toroonzddr00.bb.telus.com (209.115.141.5) [AS 852] 60 msec 64 msec 64 msec 10 iolite.sentex.ca (209.112.4.3) [AS 15290] 64 msec 60 msec 64 msec 11 ns.sentex.ca (199.212.134.1) [AS 11647] 64 msec 64 msec 60 msec sl-bb20-ana> I am guessing a blackhole, but I dont see where they told me or what list that IP address is on... www.openrbl.org shows clean and all the box does is outbound smtp... Anyone else see strange things like this ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 5

False-alarm generator
by Sean Donelan 26 Sep '02

26 Sep '02

How does the government know when the public telephone network is down? They call AT&T. How does the government know when the Internet is down? They pay contractors lots of money to put colored maps on the wall. http://www.fcw.com/fcw/articles/2002/0923/web-ncs-09-26-02.asp In other words, much the same thing several thousand ISP NOCs do all the time with their own systems. Some ISPs also provider their customers with outage notification through e-mail, web sites and fax. The big difference is having someone with the expertise and background to analyze the data, to tell the difference between "normal" Internet problems and "real" Internet problems. Things turn "red" on the Internet all the time, it was designed that way. Unfortunately, this seems to be the government version of Netmedic or Zonealarm. Too many false-alarms and lack of useful information for network operators. Why do ISPs want to provide free consulting advice to debug why a government map turned red today? If it is like Zonealarm or Netmedic, most of the "alarms" are due to problems with the customer's application. If the government is interested in Internet outages, why not just subscribe to ISP outage lists and hear the story direct from the source. Or buy a 56K to T1 connection to many different ISPs in various parts of the country. ISPs don't like debugging non-customer problems, but they will at least glance at customer reported problems. Personal opinion only.

2 1

Security/operations roles/interactions
by Pete Kruckenberg 25 Sep '02

25 Sep '02

I have the opportunity to redefine some roles of our Network Security group and Operations group. More specifically, Operations want to be more involved in day-to-day security activities like incident management and security monitoring. The goal is to make both groups more effective and valuable to our customers (and each other). I realize that solution will be specific to our organization and how we do business. But I hope to have a head-start and hopefully avoid some mistakes. It would be helpful to hear from the list how these groups seem to work best together and what division of labor has worked best to "leverage" their particular strengths. Private responses welcomed, and I'd be happy to report back to the list if there is interest in the results. Pete.

1 0

Good Aricle on Restoration of 140 West Street
by Frank Coluccio 25 Sep '02

25 Sep '02

http://lw.pennnet.com/Articles/Article_Display.cfm? Section=Articles&Subsection=Display&ARTICLE_ID=152426

1 0

i think terroists are going to love ipv6
by Joe Baptista 25 Sep '02

25 Sep '02

http://www.circleid.com/articles/2539.asp and i expect so will freedom fighters in china et. al. Maybe the subject of a future interview. and the biggest question of all, will china block the ipv6 protocol for homeland security reasons? i look forward to some answers. Cheers Joe Baptista -- Planet Communications & Computing Facility a division of The dot.GOD Registry, Limited

9 11

Fiber Cut, TX?
by Marius Strom 25 Sep '02

25 Sep '02

We've got some problems with Qwest outsourced dial in eastern Texas, and Qwest is telling us that the telcos (KMC, AT&T, Time Warner) are reporting a fiber cut, but aren't willing to give out a location. Has anyone heard of a fiber cut in the vicinity of Texas (yeah, I know that's really broad, but that's all I've got to go on)? -- /-------------------------------------------------> Marius Strom | Always carry a short length of fibre-optic cable. Professional Geek | If you get lost, then you can drop it on the System/Network Admin | ground, wait 10 minutes, and ask the backhoe http://www.marius.org/ | operator how to get back to civilization. \-------------| Alan Frame |---------------------->

1 1

Agenda topics (so far) for Eugene
by Susan Harris 25 Sep '02

25 Sep '02

The NANOG26 meeting dates are Oct. 27-29, and you'll find abstracts for most of the talks here: http://www.nanog.org/mtg-0210/topics.html Sunday Tutorials --------------- * Managing IP Networks with Free Software (Level: Intermediate) Joe Abley, Internet Software Consortium * IPv6 Basics (Level: Introductory/Intermediate) Tony Hain, Cisco * BGP Troubleshooting Techniques (Level: Introductory/Intermediate) Phil Smith, Cisco * ISP Security - Real World Techniques II Barry Raveendran Greene, Cisco Kevin Houle, CERT General Session --------------- * Update on the National Strategy for Cyberspace Security Paul Kurtz, Office of Cyberspace Security * Operational Feedback to IP Equipment Vendors Vijay Gill, AOL Time Warner * Route Flap Damping: Harmful? Randy Bush, IIJ * Experiences With Developing, Testing, Planning, and Operating IPv6-Enabled Nameservers Paul Vixie, PAIX * How to 0wn the Internet in Your Spare Time Stuart Staniford, Silicon Defense, Vern Paxson, ICSI/ICIR Nicholas Weaver, UC Berkeley * Where Are the Limits of Manageability for RFC 2547 VPNs? Randy Bush, IIJ & Jim Griffin, AT&T Research * Panel: Services, Complexity, and the Internet: What Direction? David Meyer, Sprint & Univ. of Oregon, moderator Randy Bush, IIJ; Vijay Gill, AOL Time Warner; Lixia Zhang, UCLA; Dave Ward, Cisco; Thomas Telkamp, Global Crossing * Panel: Persistent Route Oscillation - Issues and Solutions. Sue Hares, NextHop, moderator Participants to date: Enke Chen, Redback * Toward Lowering the Load on DNS Root Nameservers Duane Wessels, The Measurement Factory/CAIDA * Observation and Analysis of BGP Behavior Under Stress Lan Wang, UCLA; Xiaoliang Zhao, USC/ISI; Dan Pei, UCLA; Randy Bush, IIJ; Daniel Massey, USC/ISI; Allison Mankin, USC/ISI; Felix Wu, UC Davis; Lixia Zhang, UCLA * Panel: Trends in Measurement and Monitoring of Internet Backbones David Meyer, Sprint & Univ. of Oregon, moderator Chris Martin, Verizon; Christophe Diot, Sprintlabs; Jennifer Rexford, AT&T Research; Mujhaid Khan, Sprint; Tony Tauber, Genuity * New Services From the RIPE NCC Henk Uijterwaal, RIPE-NCC * Carrier Class Availability for IP Networks Sanjay Kalra, Juniper * Traffic Characteristics and Capacity Planning Thomas Telkamp, Global Crossing * Commercial IPv6 Deployment by ISPs in Japan J. Hagino, IIJ/KAME * Scriptroute: A Public Internet Measurement Facility Neil Spring, David Wetherall, & Tom Anderson, Department of CSE, University of Washington BOFs ---- * Toolmaker BOF Joe Abley, ISC, moderator * ISP Security BOF I Barry Raveendran Greene, Cisco & Merike Kaeo, merike.com, moderators

1 0

I agree with Susan ....
by Joe Baptista 25 Sep '02

25 Sep '02

and those who are interested in exploring the future of ipv6 and contributing to my next article are welcomed. including my detractors on this list. contact me privately. susans getting a little dictatorial but i'll respect her position if everyone gets spanked. i can support the technical position of my article - but my detractors keep alluding to fiction and never have pointed out what is wrong with the statements made. Cheers Joe Baptista -- Planet Communications & Computing Facility a division of The dot.GOD Registry, Limited ---------- Forwarded message ---------- Date: Wed, 25 Sep 2002 10:06:58 -0400 (EDT) From: Joe Baptista <baptista(a)dot-god.com> To: Susan Harris <srh(a)merit.edu> Cc: nanog-support(a)merit.edu, Publisher - CircleID Network <ali(a)circleid.com> Subject: Re: i think terroists are going to love ipv6 this isn't a political discussion this is fact. but i will cease with the warnings. those who are interested can semd me provate email. i'm pulling together a team to examine these issues. however i do agree with you that politics will impose itself on ipv6 technology. and isp's will be forced to participate in the fight against any form of political lobby against some authority or monied interests. but certainly my concerns with respect ti the spam is critical to this list. at least i see alot of that. now i hope your also sending this warning out to the people who are calling the article nonsens. i expect network administrators top point out where i have been mislead. it is after all leading members of the industry who i have interviewed. vint cerf is no small bananas and the advice provided in the article certainly is relevant to network engineering and operational issues. so i expect you to provide me with some written assurances that those hoi paloy hecklers have been appropriately bitch slapped by you. whats good for the goose is good for the gander so the saying goes. so relax - take a valium - be happy. we both know the isociety tries to quite the truth and i suspect your a leading member here if you don't warn those others. i expect you to do the right thing. love and kisses XOXOXOXOX joe baptista On Wed, 25 Sep 2002, Susan Harris wrote: > Mr. Baptista - The NANOG list focuses on discussion of backbone network > engineering and network operational issues. Please keep political > commentary in private email. Refer to the NANOG list AUP: > > http://www.nanog.org/aup.html > > I contacted you two years ago about another AUP violation on your part. If > you continue to violate the AUP, we'll need to remove your posting > privileges from the list. > > Susan Harris, Ph.D. > Merit Network/Univ. of Mich. > > On Wed, 25 Sep 2002, Joe Baptista wrote: > > > > > > > On Wed, 25 Sep 2002, Kurt Erik Lindqvist wrote: > > > > > > > > Not commenting on some of the fantasies in the article.... > > > > you should point out any fantasies you find in the article. i can support > > my findings with facts. fiction is a best a condition dictated by > > bureacrats, and on the internet that end up a comedy of errors. ipv6 is > > an end control system at this time in an ipv6 cloud where the ends are > > under complete end user control. i love ipv6. am looking forward to > > playing with it. > > > > > From what I remember China is pretty is active in IPv6 and from the > > > APNIC presentations they also have a allocation. Not sure how come to > > > the conclusions you do.... > > > > who cares. China is not aware of the security implications to the > > homeland. china is after all a nation ruled by madarines. the colours of > > authority change with the wind but the rules of the mandarine class has > > not ended. order is critical to the natural balance of chiness society. > > > > ipv6 challenges order. so what will the nat wall of china do now. i > > shall of course be investigating. i think icann goes to china next ;) > > > > cheers > > joe > > > > > > > > - kurtis - > > > > > > On onsdag, sep 25, 2002, at 11:55 Europe/Stockholm, Joe Baptista wrote: > > > > > > > > > > > > > > > http://www.circleid.com/articles/2539.asp > > > > > > > > and i expect so will freedom fighters in china et. al. Maybe the > > > > subject > > > > of a future interview. and the biggest question of all, will china > > > > block > > > > the ipv6 protocol for homeland security reasons? > > > > > > > > i look forward to some answers. > > > > > > > > Cheers > > > > Joe Baptista > > > > > > > > -- > > > > Planet Communications & Computing Facility > > > > a division of The dot.GOD Registry, Limited > > > > > > > > > > > >

1 0

Re: i think terroists are going to love ipv6
by Miquel van Smoorenburg 25 Sep '02

25 Sep '02

In article <cistron.Pine.LNX.4.33.0209250824550.1530-100000(a)dot-god.com>, Joe Baptista <baptista(a)dot-god.com> wrote: >On Wed, 25 Sep 2002, Kurt Erik Lindqvist wrote: > >> Not commenting on some of the fantasies in the article.... > >you should point out any fantasies you find in the article. The main focus of this growth is to ensure that the IPv4 distribution nightmare that left Europe, Asia and Africa with an infrastructure shortage is not repeated. Hmm, the old "everything outside the USA is a third world country" again. "Europe has a shortage of IP addresses". Not. Mike. -- Computers are useless, they only give answers. --Pablo Picasso

1 0