September 2002 - Test - lists.nanog.org

Reminder: Pre-NANOG 26 Oregon Rafting Adventure
by Daniel Golding 24 Sep '02

24 Sep '02

Hello! Just a reminder about the Pre-NANOG 26 Oregon Rafting Adventure. (More information lives at http://www.users.qwest.net/~mdrose7/) When: October 26th, the day before NANOG 26 starts. Where: The Upper Mckenzie River, www.hcexpeditions.com What about a Hotel: Many of us are staying the nights before and after at The Belknap Resort, then caravanning to Eugene on Sunday morning. How Far: About 50 miles from Eugene Where should I fly into: PDX Airport - Portland. This should be less expensive than trying to fly into Eugene. Who is running this?: This trip is being coordinated by Mitchell Rose and Daniel Golding. Ren Nowlin ordinarily runs these things, but she's in China, so we have been left in charge. Fear it. :) Who can come: Anyone who wants to. What's included: All day rafting, lunch, and use of the Hot Spring at the Belknap Resort. How Much: $75, but there may be discounts if we can get enough folks. How do I sign up?: Send email to dgold(a)fdfnet.net. I'll get back to you with information on how to sign up. The cutoff date for this adventure is 10/3/02. After that, it's purely "space available" Transportation: None, but we can all carpool there and back. Please let me know if you need or want a ride, or can provide one. Is fun guaranteed?: Yes. Thanks, Daniel Golding and Mitchell Rose

1 0

Re: Whitehouse Tackels Cybersecurity
by Steven M. Bellovin 24 Sep '02

24 Sep '02

In message <3D8899BF.6060301(a)ehsco.com>, "Eric A. Hall" writes: > > >on 9/18/2002 10:12 AM Sean Donelan wrote: >> On Wed, 18 Sep 2002 sgorman1(a)gmu.edu wrote: >> >>>A little flavor of what I'd alluded to in some of the previous >>>threads. Any guesses what the proposal to change both BGP and DNS to >>>improve security might entail?? >> >> The official document should be posted on WhiteHouse.GOV later today. > >Is it on again? See http://www.whitehouse.gov/pcipb/ A news story I saw said that they're treating this as a draft, too, and asking for two months of public comment. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

29 53

Popular trouble ticket management system for IP NOC
by Yu Ning 24 Sep '02

24 Sep '02

Hi nanog, Have any idea of the current popular trouble ticket system for the NOC ? The system used to accept, dispatch, close, store and search trouble ticket or customer case ? It's pretty much a NOC work flow system, but more focused on IP NOC. So what's the popular one ? How about HP help desk, or CA ? Any other ? thanks for any input. Yu Ning ______________________________________ (Mr.) Yu Ning, Vice Director Networking & Engineering Dep. North Telecom BU, China Telecom Beijing, P.R.China +86-10-66501239 Personal Page-> http://navidog.126.com ______________________________________

5 5

Cogent service
by Arie Vayner 24 Sep '02

24 Sep '02

Hi Does anyone have any comments (good or bad) about Cognet as a transit provider in New York? They seem to be too cheap. Arie

18 24

Pricing model for transit services
by Olivier Bonaventure 24 Sep '02

24 Sep '02

Hello, We are working on a research project on interdomain traffic engineering and would like to quantitatively evaluate interdomain traffic engineering solutions in a realistic way. We have a BGP simulator that allows us to simulate networks with a few hundreds of AS and are adding several mechanisms to this simulator. To complement the simulator, we are looking for realistic cost models of transit services. Since we do not buy transit services, we have some difficulties finding this information. For the moment, our cost models are the following : - flat fee for a L Mbps link - volume based, y $ per Mbps (95% quantile) for a L Mbps link - burstable, flat fee for x Mbps on a L Mbps and z $ per Mbps above x We would like to know whether these three cost models accurately reflect the current pricing schemes of transit services and what are the most popular ones ? If you know other pricing schemes that should be taken into account, we would appreciate to have additional information. I heard of destination-based pricing schemes, but do not have enough details on them and don't know whether they are frequently used. You can either answer directly to us (Olivier.Bonaventure(a)info.fundp.ac.be and suh(a)info.ucl.ac.be) and we will summarize or directly to the list. Thanks a lot for your help, Olivier Bonaventure --- http://www.infonet.fundp.ac.be

7 7

AS3303 customer under attack
by Andre Chapuis 24 Sep '02

24 Sep '02

Dear NOC /Nanog, We (Swisscom, AS3303) have a customer that is being attacked for about 5 days now. It is a DOS attack with spoofed source IP addresses. The destination network is: 193.77.0.0/16 , as-path 3303 8437 5603 2610 The attack is (at least !) 100Mb/s, and is coming from different peers. Yesterday it was on our peerings with AS7018 and AS6453 in Palo-Alto, today seems to be more on the AADS in Chicago. I applied the following packet filter (access-list 19 below) to all our external links, and there is a huge amount of packet with those source IP coming in. Although we drop these packets at our ingress, may i ask everyone peering with us (and others if you feel concerned) to configure that packet filter in output ? Thanks a lot for your help (or feedback if you are also experiencing such problems) and have a nice day André ----------------------------------------------------------------------- access-list 19 deny 0.0.0.0 0.255.255.255 access-list 19 deny 1.0.0.0 0.255.255.255 access-list 19 deny 2.0.0.0 0.255.255.255 access-list 19 deny 5.0.0.0 0.255.255.255 access-list 19 deny 7.0.0.0 0.255.255.255 access-list 19 deny 10.0.0.0 0.255.255.255 access-list 19 deny 14.0.0.0 0.255.255.255 access-list 19 deny 23.0.0.0 0.255.255.255 access-list 19 deny 31.0.0.0 0.255.255.255 access-list 19 deny 36.0.0.0 0.255.255.255 access-list 19 deny 37.0.0.0 0.255.255.255 access-list 19 deny 39.0.0.0 0.255.255.255 access-list 19 deny 41.0.0.0 0.255.255.255 access-list 19 deny 42.0.0.0 0.255.255.255 access-list 19 deny 58.0.0.0 1.255.255.255 access-list 19 deny 60.0.0.0 0.255.255.255 access-list 19 deny 70.0.0.0 1.255.255.255 access-list 19 deny 72.0.0.0 7.255.255.255 access-list 19 deny 82.0.0.0 1.255.255.255 access-list 19 deny 84.0.0.0 3.255.255.255 access-list 19 deny 88.0.0.0 7.255.255.255 access-list 19 deny 96.0.0.0 31.255.255.255 access-list 19 deny 169.254.0.0 0.0.255.255 access-list 19 deny 172.16.0.0 0.15.255.255 access-list 19 deny 176.0.0.0 15.255.255.255 access-list 19 deny 192.0.0.0 0.0.0.255 access-list 19 deny 192.0.2.0 0.0.0.255 access-list 19 deny 192.168.0.0 0.0.255.255 access-list 19 deny 222.0.0.0 1.255.255.255 access-list 19 deny 224.0.0.0 31.255.255.255 access-list 19 permit any --------------------- Andre Chapuis IP+ Engineering Swisscom Ltd Genfergasse 14 3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 ----------------------

1 0

RE: Cogent service
by Frank Scalzo 23 Sep '02

23 Sep '02

This was a totally bogus reason from the very beginning. Given that real backbones carry no prefixes longer than 24 bits the "long" lookup in Last numbers I saw put 701 at over 100k prefixes in the /25-/32 range. The more correct statement is backbones carry no external prefixes longer then /24. The point is there can be a HUGE number of internal prefixes that can make a difference. I will admit 701 route bloat, is not a typical example.

1 0

Security Practices question
by John M. Brown 23 Sep '02

23 Sep '02

I have question for the security community on NANOG. What is your learned opinion of having host accounts (unix machines) with UID/GID of 0:0 otherwords jmbrown_r:password:0:0:John M. Brown:/export/home/jmbrown:/bin/mysh The argument is that way you don't hav to give out the root password, you can just nuke a users UID=0 equiv account when the leave and not have to change the real root account. Now, don't flame me over the question, but provide valid pro's or con's for this practice from your experience. thank you. the reason I'm asking is important. john brown

9 9

Re: Wireless insecurity at NANOG meetings
by Huopio Kauto 23 Sep '02

23 Sep '02

How about just plainly blocking the most obvious holes, that is telnet and POP? If someone wants a direct telnet connection to a route server or something similar - open a hole with a web-based tool? Ok, then you say all unencrypted www traffic with plain username/pw.. SSH'ing everything back to home base is quite useful :) --Kauto

2 1

Re: Wireless insecurity at NANOG meetings
by Steven M. Bellovin 23 Sep '02

23 Sep '02

In message <006a01c2630a$19725020$ab876540(a)amer.cisco.com>, "Stephen Sprunk" wr ites: > >I can't say without a sniffer, but I'd bet that most NANOG participants are >doing the same: SSH or IPsec VPN's back to home (wherever that is). Experience doesn't support this, I fear. How many passwords were captured last time? --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com ("Firewalls" book)

2 1