November 2003 - Test - lists.nanog.org

ISPs' willingness to take action
by kenw＠kmsi.net 03 Nov '03

03 Nov '03

I'm a little puzzled, and I hope people won't object to my asking about this. As I see it, we're experiencing an ever-increasing flood of garbage network traffic. While not all of it is easy or appropriate to target, it seems to me there's some "low hanging fruit" that could generate serious gains with relatively little investment. A few things that make sense to me (as a non-ISP network consultant) include: 1) Summarily fencing/sandboxing/disconnecting clients sending high volumes of spam, virii, etc. You might politely contact your commercial/static clients first, but anyone connecting a "bare" PC on a broadband circuit is too stupid to deserve coddling. The great majority of your clients would thank you profusely. So far as I can see, detection of serious abusers should pretty straightforward. It wouldn't require any pretense at spam or virus filtering, per se; just pick off the clients that are flagrant sources of the plague of the month. 2) Notwithstanding the above, would it really be so hard to trap network packets bearing clear signatures of the "plague of the month"? Sure, it would create an extra load on routers or require special filtering hardware, but wouldn't it be worth it? Again, no need to be comprehensive; just blast the ones that are easy pickings. 3) There was a thread a little while ago that talked about a way to cut down spam by simply restricting who you would accept SMTP traffic from. Unfortunately, I don't recall the details, but at the time it struck me as eminently sensible, and just required cooperation between ISPs to implement effectively. One problem for the average ISP would be the monitoring and updating of plague control infrastructure. It would probably be a lot easier with a bit of cooperation and sharing -- either that, or someone could get rich offering services to ISPs for a fee. By the way, can anybody explain to me a legitimate use for port 135/137 traffic across the Internet, like it's somebody's private LAN? Seems to me anybody who still thinks that's legitimate is living in the past. So, the big question: why don't ISPs do more of this? Are they afraid of client reaction? Doesn't wash, for me: most clients would be highly grateful, and all it really takes for the remainder is fair warning. Cost? Again, you can judge for yourselves how low the fruit you choose to pick; the biggest gains have the best ROI. Happy clients, liberated bandwidth, faster servers -- what's to loose? /kenw Ken Wallewein CDP,CNE,MCSE,CCA,CCNA K&M Systems Integration Phone (403)274-7848 Fax (403)275-4535 kenw(a)kmsi.net www.kmsi.net

15 18

Re: Sabotage investigation of fiber cuts in Northwest
by JC Dill 03 Nov '03

03 Nov '03

At 08:53 PM 11/2/2003, you wrote: >I'm fairly certain that the telco huts or CO's have to accomodate multiple >groups having access, so I'd bet that a padlock probably is a tough sell There are special latches that accommodate multiple padlocks, where unlocking any one padlock opens the latch. They are routinely used on private gates in remote areas where each property owner (and the local fire department) have individual locks on the gate and opening any one lock allows access. One such device is shown on here: <http://www.tayhope.com/mlus.htm> jc

7 8

Hijacked IP space.
by chuck goolsbee 03 Nov '03

03 Nov '03

All, Sorry, to interrupt any off-topic rambles, but I had a client call last week who had just had some telephone abuse heaped on them, by somebody accusing them of spamming. It turns out our client had a netblock assigned to them back in the mid-90's. They used to put on networking trade shows, and used the space for making show networks. They haven't put on a networking trade show (with a public network) since about 1997. Of course to complicate the matter, the sole contact listed in whois no longer works there. I informed our client how to remove their name from the whois record and relinquish the netblock back to ARIN, which I hope they are doing now. I also have (at the suggestion of some research through the nanog archives) submitted the netblock to the completewhois site. [I have no interest in commenting on the current inane OT nanog thread about that subject, so don't even try me.] Mr. Thomas' cymru.com service was offline when I tried to contact it last week (he replied via email about an outage... sorry to hear... coffee will get there eventually. Order put to the roaster today. - hang in there.) Of course I have no hard data, other than my client's phone call about another phone call, so I can't query based on a timestamp to see where this was being announced from. It appears to vanished, and has remained so according to my casual glances here and there. The netblock in question is: 204.89.0.0/21 So, my question is: Other than the above, and mentioning it here, is there anything else *I* can do to assist my client? Especially since I am not at all directly related to this netblock in any way. Additionally, it would not hurt to know if anyone here *does* know when or where the announcement came from. The client in question are good folks, and I hate to see their reputation tainted by the actions of others. Thanks, --chuck goolsbee, digital.forest

1 0

Re: Sabotage investigation of fiber cuts in Northwest
by Eric Kuhnke 03 Nov '03

03 Nov '03

The Qwest CO in downtown Bellingham WA has a large microwave drum aimed at Orcas Island in the San Juans. The Qwest tower on Orcas has line of site, and what appears to be microwave DS3 rigs aimed at both Anacortes and Friday Harbor. Friday Harbor has a spur of the fiber line (SOUTH of the cut) connecting it to Everett and Seattle. Now I'm no wireless wizard, or Qwest engineer, but it wouldn't be terribly difficult to route 911-destined calls via microwave to the 911 call center. Whatcom County, which had its 911 service knocked out due to the fiber cut does not have a local 911 emergency operations center. 911 calls are routed to somewhere in Snohomish county, approximately 55 miles south on I-5. >If a single fiber cut takes them out, it's not _just_ Qwest's fault.

1 0

Re: Sabotage investigation of fiber cuts in Northwest
by Eric Kuhnke 03 Nov '03

03 Nov '03

As a resident of this area, I can say that the place where this regen hut is located is *very* rural. Burlington Northern/Santa Fe railroad tracks pass through a lot of sparsely populated farm land on the route between Mt. Vernon and Bellingham, WA. Even if the hut is locked with a high quality padlock, it's likely nothing that 5 minutes with leverage-action bolt cutters can't handle. Police/Fire/Ambulance response time to the area of Edison and Samish Island can be 20 minutes or more on a *good* day. There are very few diverse fiber routes between Vancouver BC and Seattle WA. Roughly in the area of highway 237 and the Samish River: http://www.mapquest.com/maps/map.adp?pan=s&mapdata=xU4YXdELrnBtd4g5hI1PGRNl… smlnk version: http://www.smlnk.com/BtkA At 08:38 PM 11/2/2003 -0500, you wrote: >KIRO TV has a report concerning the fiber cuts targeting a particular >fiber route in the Northwest US. It has been been disrupted four times >in the last two years, not by backhoes, but by someone entering a >fiber hut. > > >North Sound 911 Service Repeatedly Targeted >by Chris Halsne KIRO 7 Eyewitness News Investigative Reporter >[...] >This person hasn't been randomly chopping entire bundles of cables, but >rather he or she is using surgical precision to black out one particular >911 emergency call center. > >Early in the morning of Sept. 3, some criminal strolled into a Qwest >Telecommunications server station with tools in hand and carefully sliced >one strand of wire. >[...] >Operators couldn't help but feel a sense of dj vu. KIRO Team 7 >Investigators have learned that someone intentionally rerouted, cut or >altered 911 service to Whatcom County on three occasions in two years. >Each time the criminal entered the same Qwest fiber optics "hut" to create >the chaos. >[...] > >http://www.kirotv.com/news/2601577/detail.html

1 0

RE: Harassment (was Re: ELAN.NET ...)
by Michel Py 03 Nov '03

03 Nov '03

> Eric Brunner-Williams wrote: > [nanog.us] > This one is my fault. I put in-addr.arpa on the protected list, > and didn't think about operational non-dns infrastructure. You can't possibly think of everything (if you could, that would be scary). Although the .us reserve list is quite extensive, some misses are unavoidable; besides nanog.us, ieee.us has been registered too. Michel.

1 0

Re: Sabotage investigation of fiber cuts in Northwest
by Stewart, William C (Bill), RTSLS 03 Nov '03

03 Nov '03

Subtopics: Redundancy, Hunters. On Sun, Nov 02, 2003 at 09:37:30PM -0500, Robert M. Enger wrote: > You'd think after three previous disruptions, that Qwest would > have enabled some form of redundancy. If a single fiber cut takes them out, it's not _just_ Qwest's fault. A service like 911 should be buying diverse access, with access rings near the customer premises, and if they can't get it they need to be thinking about Microwaves, and if they can't get that they need to think about locating their 911 services somewhere that they _can_ get diversity. Sometimes there are right-of-way issues, so all the fibers go though one place (and I don't expect newspapers to be real precise about whether they're cutting one fiber or one bundle of fibers), but a flood or backhoe doesn't care. A decade ago it was possible to buy physically diverse T1s from most of the LECs where their networks supported it, with physical diversity between the customer prem and the wire center, though most of them no longer offer diversity at that speed (I don't remember how many still offer it at T3 and how many are only at OC3.) John Osmun wrote: > Farmington, NM doesn't have any redundancy either. Two types > of problems seem to drive the 3 or 4 outages in the last few years: > - electrcity cut-off at fiber regen sites because no one pays > the rural electric co-ops > - target shooting of splice boxes One of my former customers, who's in the forestry business, runs T1 cables along their railroad tracks down in the southeast. They occasionally have the usual problems with wet cables, etc. Where they've got bridges, the cables hang down below the tracks, and those also are subject to shotgun fade during hunting season. I don't know how much of it is because birds sitting on the wires make an attractive target for guys named Bubba, and how much is that after shooting up the local stopsigns, Bubba wants more of a challenge, but either way, it seemed to have been a consistent problem. Bill Stewart

1 0

RE: Harassment (was Re: ELAN.NET ...)
by Michel Py 03 Nov '03

03 Nov '03

> Scott Call wrote: > The ethics and/or legality of registering > nanog.us notwithstanding, That's what we are talking about, I think. There is value in a name; for example, Neustar (nic.us) has reserved whitehouse.us (see whois below). I would not have been too worried about some jerk trying to pretend that he's the President of the United States because his email address is president(a)whitehouse.us (besides, whitehouse.com has provided us with enough Bill Clinton jokes). Most people know better. What is to be concerned about is some troll doing something like http://www.wiana.org/ (they hijacked 1.0.0.0/8) with nanog.us. Maybe we know better, but not everyone. Michel. DOMAIN whois information on WHITEHOUSE.US ] [Query Origin: Main Whois Query ] [whois.nic.us] Domain Name: WHITEHOUSE.US Domain ID: D665758-US Sponsoring Registrar: .US RESERVE Domain Status: clientDeleteProhibited Domain Status: clientTransferProhibited Domain Status: clientUpdateProhibited Domain Status: inactive Registrant ID: NEUSTAR Registrant Name: NEUSTAR Registrant Address1: Loudoun Tech Center Registrant Address2: 45980 Center Oak Plaza Registrant City: Sterling Registrant State/Province: VA Registrant Postal Code: 20166 Registrant Country: United States Registrant Country Code: US Registrant Phone Number: +1.5714345757 Registrant Facsimile Number: +1.5714345758 Registrant Email: support(a)neustar.us Registrant Application Purpose: P1 Registrant Nexus Category: C21 Administrative Contact ID: NEUSTAR Administrative Contact Name: NEUSTAR Administrative Contact Address1: Loudoun Tech Center Administrative Contact Address2: 45980 Center Oak Plaza Administrative Contact City: Sterling Administrative Contact State/Province: VA Administrative Contact Postal Code: 20166 Administrative Contact Country: United States Administrative Contact Country Code: US Administrative Contact Phone Number: +1.5714345757 Administrative Contact Facsimile Number: +1.5714345758 Administrative Contact Email: support(a)neustar.us Administrative Contact Application Purpose: P1 Administrative Contact Nexus Category: C21 Billing Contact ID: NEUSTAR Billing Contact Name: NEUSTAR Billing Contact Address1: Loudoun Tech Center Billing Contact Address2: 45980 Center Oak Plaza Billing Contact City: Sterling Billing Contact State/Province: VA Billing Contact Postal Code: 20166 Billing Contact Country: United States Billing Contact Country Code: US Billing Contact Phone Number: +1.5714345757 Billing Contact Facsimile Number: +1.5714345758 Billing Contact Email: support(a)neustar.us Billing Contact Application Purpose: P1 Billing Contact Nexus Category: C21 Technical Contact ID: NEUSTAR Technical Contact Name: NEUSTAR Technical Contact Address1: Loudoun Tech Center Technical Contact Address2: 45980 Center Oak Plaza Technical Contact City: Sterling Technical Contact State/Province: VA Technical Contact Postal Code: 20166 Technical Contact Country: United States Technical Contact Country Code: US Technical Contact Phone Number: +1.5714345757 Technical Contact Facsimile Number: +1.5714345758 Technical Contact Email: support(a)neustar.us Technical Contact Application Purpose: P1 Technical Contact Nexus Category: C21 Created by Registrar: .US RESERVE Last Updated by Registrar: .US RESERVE Domain Registration Date: Thu Apr 18 18:14:15 GMT 2002 Domain Expiration Date: Tue Apr 17 23:59:59 GMT 2007 Domain Last Updated Date: Thu Apr 18 18:14:22 GMT 2002 >>>> Whois database was last updated on: Mon Nov 03 15:22:40 GMT 2003 <<<< NeuStar, Inc., the Registry Administrator for .US, has collected this information for the WHOIS database through a .US-Accredited Registrar. This information is provided to you for informational purposes only and is designed to assist persons in determining contents of a domain name registration record in the NeuStar registry database. NeuStar makes this information available to you "as is" and does not guarantee its accuracy. By submitting a WHOIS query, you agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data: (1) to allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via direct mail, electronic mail, or by telephone; (2) in contravention of any applicable data and privacy protection laws; or (3) to enable high volume, automated, electronic processes that apply to the registry (or its systems). Compilation, repackaging, dissemination, or other use of the WHOIS database in its entirety, or of a substantial portion thereof, is not allowed without NeuStar's prior written permission. NeuStar reserves the right to modify or change these conditions at any time without prior or subsequent notification of any kind. By executing this query, in any manner whatsoever, you agree to abide by these terms. NOTE: FAILURE TO LOCATE A RECORD IN THE WHOIS DATABASE IS NOT INDICATIVE OF THE AVAILABILITY OF A DOMAIN NAME. All domain names are subject to certain additional domain name registration rules. For details, please visit our site at www.whois.us.

4 4

DDoS detection and mitigation systems
by Mailing List Subscriptions 03 Nov '03

03 Nov '03

I am looking for real world feedback on the effectiveness of DDoS detection and mitigation devices from Riverhead, Top Layer, ISS (Proventia), Melior, etc. Some of them make pretty impressive claims of performance, too good to be true? This would be used in conjunction with other techniques as part of the defenses in layers approach to DDoS protection for my client. An important consideration would be the ability to scale to Gbps rate and beyond. Also, has anyone deployed Arbor Networks Peakflow or similar platforms to successfully detect and mitigate sizeable (100+ Mbps) DDoS attacks involving 1,000-20,000 attack sources? Do you use/develop in-house tools to analyze Netflow on your peering routers and have that interface in near-realtime with the said routers to null route (BGP and RPF) the offending sources? Last but not least, how many of you offer (or would offer) DDoS protection with strict SLA (e.g. attacks mitigated within X time units) as a value-added service? Thanks! Regards, Joe

3 2

Need contact
by Jeffrey Sharpe 03 Nov '03

03 Nov '03

Could someone from Road runner contact me off list please? This is for a routing issue. ------------------------------------------------ Jeffrey Sharpe CyberLynk Helpdesk and Support 414.858.9335 or 800.942.8022 support(a)cyberlynk.net ------------------------------------------------

1 0