November 2003 - Test - lists.nanog.org

Re: [Re: Fun new policy at AOL]
by Dr. Jeffrey Race 11 Nov '03

11 Nov '03

On Tue, 11 Nov 2003 20:47:42 -0500, joshua sahala wrote: >i'm still curious to know how this mail will be automagically rejected... NOT automatically rejected. It takes an act of management will. That is the point. More comments in due course. Late now . . . caffeine and sugar levels low in bloodstream . . . RSI . . . sleepy . . . (: Jeffrey Race

1 0

Re: law enforcement contacts
by J. Oquendo 11 Nov '03

11 Nov '03

On Mon, Nov 10, 2003 at 10:36:03PM -0500, Valdis.Kletnieks(a)vt.edu wrote: > On Mon, 10 Nov 2003 13:55:40 PST, JC Dill <nanog(a)vo.cnchost.com> said: > > > I have several clueful LEO contacts, but this information will be of no use > > to you unless the crime was committed within their respective > > jurisdictions. LEOs get paid to act on crimes within their jurisdiction, > > not on crimes within their expertise. <rant> Uhm... Correct me if I missed something, but LEO's get paid to uphold the law BY ACTING on crime in their expertise and if it's out of their range (juridstiction) an `LEO` should have better contacts than someone on the outside. > > On the flip side, if the LEO in question is at the state level, and it's > a DDoS zombie network, there's a good chance that at least one of the > zombies is in the state and therefor fair game. > You make it seems as if the typical LEO will even know what a zombie network is. I don't want to take anything away from those decent LEO's that know a thing or two, but I've seen an unnamed `LEO` for an agency in `a` government testify that he didn't understand what an IP address on a witness stand. One thing to keep in mind when calling in LEO's, and if you search in Security Focus' arhives you may find it, is the cost of it all. Does it outweigh the benefit. Meaning are you willing to have an LEA come into your business unhook machines to replicate disks, etal, in order to stop something you could easily assess with some good configuring of a network? Think about it, if by giving permission to an LEA to come in to your data center to do what they have to do is going to cost you more in the long run, then why not see what you can do on your own via looking for the contacts (owners of the `zombie` machines) on your own. > Even quite a good chance for LEO at the city/county level, for some of the > larger cities/counties.... Many people in the compsec -- well computing industry in general -- tend to think that LEA's are super equipped for most things in relevance to cybercrime. The fact is they're not, and I'm sure many have seen articles showing this. LEA's train with guns not computers, and for those who are already in the field, I'm sure they are a fraction of what someone's personal perception thinks the ratio is. To make a long rambling short, if an attacker with a zombie network is coming in from different ranges, you're better off contacting the DoJ here in the US, as it is an interstate matter, I'm sure they'll love to get another example this time of year. LEA's locally are likely to do the same (contact other agencies) if it's a given that the attacker(s) are acting as I perceive them to be (different hosts, different networks, states, etc.), the feds have more money to deal with that, and if they can't find the culprit, then I'm sure they'll find someone who will pay for the crime. (a culprit or course I wouldn't insinuate anything). </rant> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= wget -qO - kungfunix.net/fatality|sed -n '1!G;h;$p' J. Oquendo sil @ politrix . org http://www.politrix.org sil @ kungfunix . net http://www.kungfunix.net sil @ perfidious . org http://www.perfidious.org

3 2

Re: [Re: Fun new policy at AOL]
by joshua sahala 11 Nov '03

11 Nov '03

"Dr. Jeffrey Race" <jrace(a)attglobal.net> wrote: > > > The proposal at <http://www.camblab.com/misc/univ_std.txt> provides that > mail from compromised sources shall be rejected. This forces the host > sysadmin to secure his system if he wants to communicate with the rest > of the internet. Presently the penalty for negligence is borne by the > victim, not the perpetrator. The unique aspect of the proposal is to > attach consequences to actions, a principle which is used everywhere in > society except the Internet. > > Jeffrey Race > > i'm still curious to know how this mail will be automagically rejected... is there a black list of compromised hosts (beyond the black lists that already exist) that i don't know about? if so, i would love to be able to use it i'm sorry dr race, but i still do not see much in your proposal (no matter how many times you submit it to the list) that i cannot already do, or that is not already being done (albeit not universally), but if you cannot compell someone to behave a certain way with current laws and best practices, a new law/best practice will not mean much. spammers will hijack/infect new computers, the blocklists will grow larger and larger, vendors will release insecure operating systems, etc, etc ,etc arbitrary black/white-lists are a mildly effective method of combatting spam now, but not everyone has one. not everyone has their own bayes-based filter on their servers. you can try to make the 'perpetrator' pay, but, as microsoft will tell you, not even big cash awards will help you. you still end up punishing the often ignorant end user, and they don't really learn how to do it better, even if they do manage to patch up a level or two. spam is big money - consumerism is big money - bad operating systems are big money - user stupidity is often more painful for the tech support rep than the [l]user my solution? education of the end user would be a good place to start. securing their 'favorite' o/s would be another. neither however, is a function of the service provider. we all spend a lot of time chasing down hackers and spammers already, then we get to do the rest of our 'normal' work. my $0.02 /joshua * and yes, i just put on my flame-retardant suit ;) **i wonder what the probabilities are regarding your emails - every one contains the same link...maybe when i get my new server setup and trained, i will find out "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

Re: Fun new policy at AOL
by Dr. Jeffrey Race 11 Nov '03

11 Nov '03

On Fri, 29 Aug 2003 00:05:50 +0100 (BST), Stephen J. Wilcox wrote: >On Fri, 29 Aug 2003, Dr. Jeffrey Race wrote: >> On Thu, 28 Aug 2003 12:07:30 -0400, Matthew Crocker wrote: >> >It can be built without choke points. ISPs could form trust >> >relationships with each other and bypass the central mail relay. AOL >> >for example could require ISPs to meet certain criteria before they are >> >allowed direct connections. ISPs would need to contact AOL, provide >> >valid contact into and accept some sort of AUP (I shall not spam >> >AOL...) and then be allowed to connect from their IPs. AOL could kick >> >that mail server off later if they determine they are spamming. >> >> Now there is an idea! However an improved variant is to make the >> entire internet a 'trust relationship' using the (obvious) steps you >> propose. For several months I have been pondering possible details of >> implementing same; see <http://www.camblab.com/misc/univ_std.txt>. >> Comments welcome. > >Surely it already is ? That is I only announce routes of my customers who I >trust, my upstreams and peers trust me and what i announce to them, their >upstreams/peers do and so on. And yet we still have hijacked netblocks and >ddos's with uncaring sysadmins. Why should email be any different? > >And if you do implement such a system, the spammers will just adapt.. the recent >viruses (sobig) are an example of how spammers can open up end user machines to >facilitate sending of email, providing they can control such a host they can >simply relay thro the providers' smtps.. they dont need open relays to send out >their junk! The proposal at <http://www.camblab.com/misc/univ_std.txt> provides that mail from compromised sources shall be rejected. This forces the host sysadmin to secure his system if he wants to communicate with the rest of the internet. Presently the penalty for negligence is borne by the victim, not the perpetrator. The unique aspect of the proposal is to attach consequences to actions, a principle which is used everywhere in society except the Internet. Jeffrey Race

1 0

Re: Router with 2 (or more) interfaces in same network
by Stewart, William C (Bill), RTSLS 11 Nov '03

11 Nov '03

While it's a more common thing to do with hosts, there are a number of reasons you might want a router with multiple interfaces on the same network. - Sometimes ugly things happen during reconfigurations, e.g. replacing two routers with one bigger one. Load balancing is more likely to want two interfaces with the same IP address, but sometimes different addresses on the same subnet makes more sense. - Security monitoring / eavesdropping applications, where one interface is listen-only or listen-mostly. Usually promiscuous interfaces are enough to do this, but there are remote monitoring applications where it might help. - You may want different policies on the two interfaces, and sometimes it's easier to do that with separate IP addresses than differentiate by TCP ports or whatever (e.g. VOIP on one interface, regular traffic on another, with a LAN switch keeping them separate.) That's especially believable if you're using an ISP that doesn't do Type of Service bits, or multiple ISPs that don't peer with ToS. - Ugly loopback thingies working around other limitations. I've mostly seen this at Layer 2, with Cisco Virtual Trunking, or building things in test labs.

1 0

need contact for verio radb
by william＠elan.net 11 Nov '03

11 Nov '03

I need to give somebody contact for verio routing database to have several of the database entries removed from there (they have beenadded without consent of ip block administrator and he does not want them there).Who would the be correct person to contact at verio? -- William Leibzon Elan Networks william(a)elan.net

2 1

Re: This may be stupid but..
by Michael.Dillon＠radianz.com 11 Nov '03

11 Nov '03

>> When I interview, I start out by asking one or two key questions that >> help me quickly get to the truth. For instance at one company, when I >> has hiring NOC folks, I started by asking them to explain traceroute >> to me. >"Which one? ICMP, UDP or TCP traceroute (to name the usual ones)?" >PS: this is the answer I'd expect from applicants... but this depends >on what cluelevel you want/need in your NOC. :-) It's not the answer I would expect. First of all, the question asked the candidate to "explain" and the answer was not an explanation. In fact, the answer was just the kind of meaningless memory work that CCxx and MSxx certified people are good at. As an interviewer, I don't want short answers like you find in a multiple choice exam. I want some detail that shows that the candidate really does have some understanding of how network protocols work on the inside. Mistakes are OK because I'm not marking the person on their perfection but I'm trying to find out how they think and how they might approach network problems on the job. It's the same reason that I like to ask candidates to tell a story about some past event and how they, personally, dealt with it. If a candidate has had real personal experience of something then they will be able to tell me a story filled with detail. On the other hand, you sometimes get people who can only say "we" did this and "we" did that which leads you to believe that maybe the person was the NOC janitor or something. The best job interview questions are the ones that don't have a right answer. --Michael Dillon

3 2

Re: Router with 2 (or more) interfaces in same network
by sthaug＠nethelp.no 11 Nov '03

11 Nov '03

> You _used_ to be able to do this (oh, over two years ago?). The address > was assigned to the interface, and the error from trying to add a duplicate > route was simply ignored, no route got added anywhere. You can figure out > when the change was made by examining the code or by seeing when the > maillists started to get flooded by people who could no longer do, > > # ifconfig if0 inet 10.0.0.1 > # ifconfig if0 alias 10.0.0.2 > > When they meant, > > # ifconfig if0 inet 10.0.0.1 > # ifconfig if0 alias 10.0.0.2 netmask 0xffffffff There is a difference, of course - Cisco is perfectly happy to let you do int fa0 ip addr 10.0.0.1 255.255.255.0 ip addr 10.0.0.2 255.255.255.0 secondary I never could understand why this should be impossible in FreeBSD. But I guess this discussion is no longer NANOG relevant :-) Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

US LEC?
by Dave Temkin 11 Nov '03

11 Nov '03

Does anyone have any experience in dealing with US Lec? I'm working with a FastNet customer who's been sold to them in FSST's bankruptcy. We have other connectivity in the meantime. Thx, -Dave

1 0

RE: Router with 2 (or more) interfaces in same network
by Michel Py 11 Nov '03

11 Nov '03

>> I am curious to know if its possible to have a router with its >> two interfaces, say configured as, 1.1.1.1/16 and 1.1.1.2/16. >> Theoretically, i see nothing which can stop a router from doing this. > Cisco's don't let you do this. I have always considered that > broken, although I'm sure Cisco thinks it's a feature. bridge irb inte f5/0 no ip add bridge group 1 inte f5/1 no ip add bridge group 1 inte bvi 1 ip add 1.1.1.1 255.255.0.0 bridge 1 prot ieee bridge 1 route ip bridge 1 bridge ip

1 0