October 2003 - Test - lists.nanog.org

"Close-knit group" responds to Verisign
by Alex Kamantauskas 03 Oct '03

03 Oct '03

In a Washington Post article, it was reported that a "close-knit group of engineers" were angered by Verisign's SiteFinder service, claiming that it caused "e-mail systems, spam blocking technology and other applications to malfunction". Verisign responded that these claims are overblown. In response, the close-knit group of engineers said, _ WILDCARD THIS! _ |_| |_| | | /^^^\ | | _| |_ (| "o" |) _| |_ _| | | | _ (_---_) _ | | | |_ | | | | |' | _| |_ | `| | | | | | | / \ | | \ / / /(. .)\ \ \ / \ / / / | . | \ \ \ / \ \/ / ||Y|| \ \/ / \__/ || || \__/ () () || || ooO Ooo -- /ak

2 1

NXDOMAIN signs (was VeriSign Capitulates)
by Marc MERLIN 03 Oct '03

03 Oct '03

We could almost pretend it was because of the NXDOMAIN signs that got plastered on their HQ :) From http://slashdot.org/article.pl?sid=03/10/01/212231&mode=nocomment&tid=126&t… wednesday: ---------------------------------------------------------------------------- Verisign seems to have issues with returning proper response packets for DNS queries on unused domains, so we thought we would give them a quick reminder in case they forgot what the right answer was. You can find pictures here ( http://irc.sh.nu/download/ ) (This was on their building in Mountain View, and the signs said 'Verisign/Netsol, as if people didn't hate you enough already... How greedy/stupid are you? [Made with figlet/vim/a2ps/poster.c] ) ---------------------------------------------------------------------------- I thought it was hilarious :) Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

1 0

DHCP / PPP host route
by Jay Greenberg 03 Oct '03

03 Oct '03

>From a service provider perspective, does anyone know if there is a way to make a cisco router that is acting as a dhcp relay agent install a /32 host route for the assigned IP address? I'm looking for a way to assign static IP addresses from the same pool independant of the router that is acting as the relay agent to the dhcp server. Thanks, -- Jason Greenberg, CCIE #11021 Network Administrator Execulink, Inc. <jg(a)execulink.com>

1 0

NTP, possible solutions, and best implementation
by Ariel Biener 03 Oct '03

03 Oct '03

Hi, Assuming one wanted to provide a high profile (say, at the TLD level) NTP service, how would you go about it ? The possibilities I encountered are diverse, the problem is not the back-end device (be it a GPS based NTP source + atomic clock backup, based on cesium or similar), but the front end to the network. Such a time service is something that is considered a trusted stratum 1 server, and assuring that no tampering with the time is possible is of very high priority, if not top priority. There are a few NTP servers solutions, I like the following comparison between one company's products (Datum, merged into Symmetricom): http://www.ntp-systems.com/product_comparison.asp However, when you put such a device on a network, you want to have some kind of clue about the investment made in that product when security comes to mind, and also the turnaround time for bug fixes should such security bug become public. Here is the problem, or actually, my problem with these devices. I know that if I use a Unix machine or a Cisco router as front end to the network for this back-end device, then if a bug in NTP occurs, Cisco or the Unix vendor will fix it quickly. BUT!, if I want to put the device itself on the network, as this is what a NTP device was built for, I feel that I have no real sense of how secure the device really is, and how long it would take for the vendor to actually fix the bug, should such be discovered. It's a black box, and I am supposed to provide a secure time source based on ... "what ?" This is my dillema. While I don't want to put a NTP front end, which becomes a stratum 2 in this case, but to provide direct stratum 1 service to stratum 2 servers in the TLD in question, I do not know how can I safely trust a device that I have no experience with how the vendor deals with bugs, and also, I have no idea what is the underlying software (although it's safe to assume that it is an implementation of xntpd, in one form or the other). Did any of you have to create/run/maintain such a service, and does any of you have experience with vendors/products that can be trusted when security is concerned (including the vendor and the products I specified above). thanks for your time, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

5 5

the gauntlet is thrown
by Scott Bradner 03 Oct '03

03 Oct '03

http://www.icann.org/correspondence/twomey-to-lewis-03oct03.htm

7 7

Re: NTP, possible solutions, and best implementation
by Michael.Dillon＠radianz.com 03 Oct '03

03 Oct '03

> Assuming one wanted to provide a high profile (say, at the TLD level) NTP >service, how would you go about it ? First of all, NTP should be done at the geographical level, not the TLD level. Generally, unless political reasons prevent it, you should try to implement an NTP service that covers a region roughly as large as Europe to avoid too much fate sharing caused by proximity. > The possibilities I encountered are diverse, the problem is not the >back-end device (be it a GPS based NTP source + atomic clock backup, based on >cesium or similar), Beware the single point of failure. If all your clocks come from GPS, then GPS is the SPOF. If they all come fram brand X manufacturer then that is the SPOF. A commercial service should be robust and use a combination of atomic clocks, GPS, radio time services, CDMA/GSM clocks combined with a sanity checker to watch all the clocks and detect bad timekeepers. > However, when you put such a device on a network, you want to have some >kind of clue about the investment made in that product when security comes to >mind, Indeed. Hide this clock behind a packet filtering firewall or else use udprelay and an application layer gateway on UNIX to block everything except NTP. In fact, if this is a commercial service you should hack udprelay so that it knows about the NTP protocol and can block non-customer traffic or malformed traffic or high volumes of traffic. That way, the UNIX server/firewall in between the NTP device and the net protects it from abuse, but since this UNIX server is a pass-through device from the point of view of NTP, it does not change the stratum level of the service any more than an IP router does. --Michael Dillon

13 14

DNS scans by IANA
by Andrew Fried 03 Oct '03

03 Oct '03

5 4

needed Comcast engineer with clue
by Gordon Cook 03 Oct '03

03 Oct '03

I apologize for bringing this to the list, but i have expended approximately 22 hours since monday on the problem without resolution and without consistent replies or consistent reliable response from comcast. The short version of situation is that i am getting between 11% and 52% packet loss to various IP adress. From the terminal window on OSX i run ping -s 1024 xxx.xx.xxx.xxx where the x's are the ip number. Under these conditions i cannot successfully sen an email with a two meg attachment. 609 394 2288 is the local number of the Trenton NJ office a few miles from my house. calls to there were routed to a national call center so that effort just failed. If i could only reach someone in their engineering dept locally who could run some configuration tests on their local routers switches etc, they could probably save further visits to my house... next one scheduled sunday between 1 and 3pm. The network at the physical level is fine. This is a layer 3 tcp/ip problem. I have replaced my cable modem and done hours of trouble shooting within my house to confirm it is not on my side of the network. I was promised an engineer this morning with laptop. They didn't keep the promise and sent a tech who checked the physical signal and went away and apparently scheduled sundays visit. comcast please contact me off list..email or phone numbers below -- ============================================================= The COOK Report on Internet, 609 882-2572 (PSTN) 703 738-6031 (Vonage) Subscription info & prices at http://cookreport.com/subscriptions.shtml License Exempt Wireless Report http://cookreport.com/12.07-08.shtml Purchase ten years of back issues at http://www.cafeshops.com/cookreportinter.6936314 E-mail cook(a)cookreport.com or use cook(a)oldcolo.com Free World Dial up 17318 =============================================================

1 0

Re: the gauntlet is thrown
by Peter H Salus 03 Oct '03

03 Oct '03

Scott Bradner writes: >> http://www.icann.org/correspondence/twomey-to-lewis-03oct03.htm God, I wish that Twomey had had someone proofread. It's a bit late to request a report by "15 January 2003." Peter --------------------------------------------------------- Peter H. Salus, Ph.D. 40 IH 35 N #4A3 Austin, TX 78701 Chief Knowledge Officer, InternetPerils, Inc. peter(a)netpedant.com +1 512 478-7562

1 0

Re: NTP, possible solutions, and best implementation
by Robert M. Enger 03 Oct '03

03 Oct '03

As Mr. Dillon observed, regional service seems prudent, if only to minimize timing problems at the IP layer, much less for reliability purposes. An alternate time source could be the GLONASS system. Receivers do exist, but I have never used one. Sanity checking sources could include WWVB in the US, and many others: http://www.cl.cam.ac.uk/~mgk25/lf-clocks.html The US FAA is transmitting WAAS correction signals. Depending on the algorithms in the GPS receiver, this may result a reduction in PPS jitter. (although any such jitter is probably swamped by the jitter at the IP layer) There is at least one GPS receiver that will deliver 20PPS output, if needed. It is often possible to directly interrogate the GPS receiver to find out how many satellites it can see, and what the signal strengh conditions are. This will allow you to verify the adequacy of the outside antenna installation. If this is serious business, then it might be prudent to make a permanent connection that allows this interrogation (terminal server interface), and to check the constellation visibility and signal conditions on a periodic basis, not just at installation time. (Someone might put something else up on the roof that blocks your antenna's view of a portion of the sky...) Best wishes, Bob Enger ----- Original Message ----- From: "Ariel Biener" <ariel(a)fireball.tau.ac.il> To: <nanog(a)merit.edu> Sent: Thursday, October 02, 2003 10:54 AM Subject: NTP, possible solutions, and best implementation > > > > Hi, > > > Assuming one wanted to provide a high profile (say, at the TLD level) NTP > service, how would you go about it ? > > The possibilities I encountered are diverse, the problem is not the > back-end device (be it a GPS based NTP source + atomic clock backup, based on > cesium or similar), but the front end to the network. Such a time service is > something that is considered a trusted stratum 1 server, and assuring that no > tampering with the time is possible is of very high priority, if not top > priority. > > There are a few NTP servers solutions, I like the following comparison > between one company's products (Datum, merged into Symmetricom): > > http://www.ntp-systems.com/product_comparison.asp > > However, when you put such a device on a network, you want to have some > kind of clue about the investment made in that product when security comes to > mind, and also the turnaround time for bug fixes should such security bug > become public. Here is the problem, or actually, my problem with these > devices. I know that if I use a Unix machine or a Cisco router as front end > to the network for this back-end device, then if a bug in NTP occurs, Cisco > or the Unix vendor will fix it quickly. BUT!, if I want to put the device > itself on the network, as this is what a NTP device was built for, I feel > that I have no real sense of how secure the device really is, and how long it > would take for the vendor to actually fix the bug, should such be discovered. > It's a black box, and I am supposed to provide a secure time source based on > ... "what ?" > > This is my dillema. While I don't want to put a NTP front end, which > becomes a stratum 2 in this case, but to provide direct stratum 1 service to > stratum 2 servers in the TLD in question, I do not know how can I safely > trust a device that I have no experience with how the vendor deals with bugs, > and also, I have no idea what is the underlying software (although it's safe > to assume that it is an implementation of xntpd, in one form or the other). > > Did any of you have to create/run/maintain such a service, and does any of > you have experience with vendors/products that can be trusted when security > is concerned (including the vendor and the products I specified above). > > thanks for your time, > > --Ariel > > > -- > Ariel Biener > e-mail: ariel(a)post.tau.ac.il > PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html >

2 1