February 2003 - Test - lists.nanog.org

IPsec with ambiguous routing
by David Wilburn 12 Feb '03

12 Feb '03

I've been attempting to beef up my knowledge of IPsec recently, and got to thinking hypothetically about a *possible* problem with implementing IPsec on larger networks. My experience with IPsec is currently limited at best, so hopefully I can communicate this properly: Let's assume that I have a large-ish network with multiple connections to the Internet and ambiguous routing (meaning that a packet might come in one gateway and the response packet might leave through a different gateway). Let's also assume that I'd like to allow IPsec tunnels into my network to allow single workstations and small networks to attach to mine. With such ambiguous routing, is my understanding correct that the response traffic could potentially bypass the VPN concentrator altogether and travel to the destination unencrypted? Is there any best practices advice for dealing with IPsec on such a network, or am I stuck with either "redesign your network architecture" or "don't allow IPsec?" From what I can figure, those last two options are my best bet, unless I want to allow lots of VPN concentrators deeper within the network where the routing is less ambiguous. Are there any solutions for quickly, reliably, and securely sharing IPsec Security Association databases between gateways, so that the other gateways would know to encrypt the traffic before letting it out? Any other relevant thoughts, experiences, insults, rude gestures, etc.? Thanks! -Dave Wilburn

4 3

RE: IPsec with ambiguous routing
by Braun, Mike 12 Feb '03

12 Feb '03

When the IPsec tunnel is formed, traffic is sent between the IPsec terminating equipment/client at the remote office and the VPN concentrator located at the other end. The source and destination networks are not seen while the data is encrypted over the WAN. Only through a configuration error could the traffic be sent unencrypted from source to destination. It makes no difference that you have multiple WAN links, or even that a potential for an asymmetrical traffic flow exists. The source and destination address as it appears in the WAN cloud always remains the same. Best regards, Mike Braun -----Original Message----- From: David Wilburn [mailto:dwilburn@mitre.org] Sent: Wednesday, February 12, 2003 10:40 AM To: nanog(a)merit.edu Subject: IPsec with ambiguous routing I've been attempting to beef up my knowledge of IPsec recently, and got to thinking hypothetically about a *possible* problem with implementing IPsec on larger networks. My experience with IPsec is currently limited at best, so hopefully I can communicate this properly: Let's assume that I have a large-ish network with multiple connections to the Internet and ambiguous routing (meaning that a packet might come in one gateway and the response packet might leave through a different gateway). Let's also assume that I'd like to allow IPsec tunnels into my network to allow single workstations and small networks to attach to mine. With such ambiguous routing, is my understanding correct that the response traffic could potentially bypass the VPN concentrator altogether and travel to the destination unencrypted? Is there any best practices advice for dealing with IPsec on such a network, or am I stuck with either "redesign your network architecture" or "don't allow IPsec?" From what I can figure, those last two options are my best bet, unless I want to allow lots of VPN concentrators deeper within the network where the routing is less ambiguous. Are there any solutions for quickly, reliably, and securely sharing IPsec Security Association databases between gateways, so that the other gateways would know to encrypt the traffic before letting it out? Any other relevant thoughts, experiences, insults, rude gestures, etc.? Thanks! -Dave Wilburn "MMS <firstam.com>" made the following annotations on 02/12/03 11:04:13 ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

1 0

RE: Spam Cost Resources [ trustworthy ]
by Mike Damm 12 Feb '03

12 Feb '03

Do these figures take into account the number of calls you will get from sales when they realize you lost the profit equivalent of 2 to 3 large business customers? Or the legal fees incurred by shutting the customer off? Most spammers work terms into their contracts whereas if it is not fulfilled to their satisfaction or if you threaten them, you have the option of buying back the contract from them (it's not as simple as just killing their circuit and telling them to go away). There is a lot more to it than just NOC man hours, which could be very detrimental to your company. --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Alif The Terrible [mailto:measl@mfn.org] Sent: Monday, February 10, 2003 7:44 PM To: Martin Hannigan Cc: nanog(a)nanog.org Subject: Re: Spam Cost Resources [ trustworthy ] On Mon, 10 Feb 2003, Martin Hannigan wrote: > > Does anyone have a resource that they believe in when it > refers to how much spam really costs Network operatos? > > http://www.nytimes.com/2003/02/09/magazine/09SPAM.html > > I'm trying to do some validation. Thanks. > > -M Hi Martin, I just did these numbers a little over two months ago, as justification for another head count (cheaper to have more heads as we shut down fewer people). Each complaint costs us about $3.50, and each "case" (more than 5 complaints get a case) costs us around $8.00. The costs associated with actually working a case varied wildly, depending on whether we shut the customer down (worst case), have to repetitively threaten to shut them down, etc... The "Average" case cost us $35.00 to work, but, as I said above, this takes a LOT of things into account. Please feel free to use these numbers, but strip identifying data, as the name associated with them (obviously) did not, and will not, consent to this stuff leaving the company. //Alif

3 2

Re: Streaming dead again.
by odlyzko＠dtc.umn.edu 12 Feb '03

12 Feb '03

On Tue, 11 Feb 2003, John Todd wrote: (snip) > Now, back to the NANOG-ish content: I know a fundamental change in > technology when I see it, and VOIP is an obvious winner. VOIP has > been smoldering for a few years, and the sudden growth of various > easy-to-implement SIP proxies and service platforms, plus the sudden > drop in price of SIP hard-phones, is going to push growth > tremendously. Currently, the underlying technology is UDP that moves > calls around. This is all well and good until you get thousands, > tens of thousands, hundreds of thousands of calls going at once. QoS > is, as Bill says, not a problem right now on public networks; I've > used VOIP across at least three exchange or peering sessions (in each > direction, no less!) and suffered no quality loss, even at 80kbps > rates. However, when a significant percentage of cable and DSL > customers across the country figure this technology out, does this > cause problems for those providers? Is it worthwhile for large > end-user aggregators to start figuring out how they are going to > offer this service locally on their own networks in order to save on > transit traffic to other peers/providers? Or is this merely a tiny > bump in traffic, not worth worrying about? > More interestingly: what happens to the network when the first > "shared" LD software comes into creation? Imagine 1/3 (to pick a > worst-case percentage) of your customers producing and consuming > (possibly) 80kbps of traffic for 5 hours a day as they offer their > local analog lines to anyone who wants to make local calls to that > calling area. > Overseas calling I expect will show similar growth. Nobody wants to > pay $.20 or even $.10 per minute to Asian nations, so as soon as Joe > User figures out how this VOIP stuff works, there will be (is?) a > tendency for UDP increases on inter-continental spans. Nothing new > here; we've all said this was coming for years. Now it's finally > possible - is everyone ready? > JT (snip) VOIP is likely to cause a financial upheaval in the telecom industry, because the overwhelming fraction of revenues still comes from voice services. However, VOIP is likely to have only a minor impact on Internet backbones. The reason is that there simply isn't that much voice traffic. Various estimates (such as those in my papers at <http://www.dtc.umn.edu/~odlyzko/doc/networks.html>) say that already there is about twice as much US Internet backbone traffic as US long distance voice traffic, and that is if you count voice as two 64 Kb/s streams of data. If you use compression, that goes down even further. Now introducing flat rate VOIP service will stimulate voice usage some, but based on various previous experiences, not by enough to make a quantum difference, especially since (again, based on previous experiences) it will take a while for VOIP to spread widely. Andrew Odlyzko

2 1

Streaming dead again.
by Eric Germann 12 Feb '03

12 Feb '03

Dying at merit.demarc.cogentco.com with 3561ms figures in traceroute. How many would pay some $$$ for this to be moved in the future to a premium service provided by someone like RealMedia. Methinks the merit servers are getting crushed. I'd pony up some $$$ to virtually attend it if it were reliable. Seems a lot less reliable this time around. FWIW, if the only video shot is a long shot of a talking head wireless discussion, save the bandwidth and only stream the audio, or cut to the slides if there are some. Burning 80k to see a pixelated animation doesn't do anyone any good. Eric ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45801 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

7 6

Re: Locating rogue APs
by Michael.Dillon＠radianz.com 12 Feb '03

12 Feb '03

> > It appears that kismet requires either someone to walk around the facility > > while running the program or that you have you have it installed on > > machines all over your site. Neither of those options interest me as a > > long term solution to rogue AP monitoring. > You could setup a laptop, a GPS with a data cable, NetStumbler[free], > and a 8dbi 2.5ghz <802.11b> antenna and pickup everything clearly > for a half a mile without walking around. I've just acquired this > setup myself. Google on "war driving +F150" and you'll see a setup > to help for < $55 If you are driving then you might want to build something using the DashPC http://www.dashpc.com/ but for walking around it's even easier if you use a Linux-based PDA like the Sharp Zaurus which runs kismet. --Michael Dillon

1 0

Lawful Interception in the world...
by Pascal Gloor 12 Feb '03

12 Feb '03

I'm trying to collect some informations on Lawfull Interception over the world... Does any country in the world require such things ? LOGS (6 months archive required) - mail header logs (all mails, in, out, relay) - pop3/imap/webmail access logs (all accounts) - dhcp/dial/adsl/gprs/whatever accounting logs (all users) RealTime - mail interception (IN,OUT,RELAY) for a certain From/To address or a certain IP. the mail has to be encrypted with PGP and sent directly to the Law enforcement as a mail attachement. Thank you for taking 2 minutes to answer to nanog or privatly, this is important. P.

6 5

RE: Lawful Interception in the world...
by Ben Buxton 12 Feb '03

12 Feb '03

> I'm trying to collect some informations on Lawfull > Interception over the > world... > Does any country in the world require such things ? It's a legal requirement for all ISPs in the Netherlands. If the government wants to snoop on someone, they have to issue a special warrant type, and the ISP must provide copies of all packets for the particular person. >From memory, there is no requirement to "decode" the packets and extract L4+ info. Just the raw IP suffices. There is a system developed and adopted by many ISPs to do this with minumum effort, and almost automated, involving dedicated switches and servers. A users packets are not logged until the warrant arrives, so they cannot say "give us all traffic that user bob sent last week". Ben > LOGS (6 months archive required) > - mail header logs (all mails, in, out, relay) > - pop3/imap/webmail access logs (all accounts) > - dhcp/dial/adsl/gprs/whatever accounting logs (all users) > > RealTime > - mail interception (IN,OUT,RELAY) for a certain From/To > address or a > certain IP. > the mail has to be encrypted with PGP and sent directly to the Law > enforcement as a mail attachement. > > > Thank you for taking 2 minutes to answer to nanog or privatly, this is > important. > > P. > >

1 0

Locating rogue APs
by John Kristoff 11 Feb '03

11 Feb '03

Apologies if this ends up on the list multiple times. I seem to have trouble getting this posted in a timely fashion. In general, MAC OUI designations may indicate a particular AP. IP multicast group participation may also be used by some APs. Some APs have a few unique ports open. Lastly, APs may be found with a radio on a particular default channel. All of these potentially identifying characteristics may be used to help audit the network for rogue IPs. Below is information on locating particular APs: Multicast Groups ---------------- 224.0.1.40 Cisco/Aironet (newer versions) 224.0.1.76 Lucent/Avaya 224.1.0.1 Cisco/Aironet You can locate who group members are by doing the following on a Cisco router: show ip igmp group <group-ip-address> Protocols/Ports --------------- Cisco/Aironet APs have two UDP ports open: 2887 and 7777. Well known AP MAC OUIs ---------------------- 0000f0 Samsung 00022d Lucent (Orinoco) 0002b3 Intel 00032f Global Sun Technology (Linksys) 00045a Linksys 0010e7 BreezeCom (BreezeNet) 0020d8 NetWave Technologies (BayNetworks) 003065 Apple 004005 ANI Communications 004096 Aironet 00508b Compaq 00601d Lucent (WaveLan) 0090d1 Leichu Enterprise Co. (Addtron) 00a0f8 Symbol Technologies 00e029 Standard Microsystems Corp. 080002 3Com 080046 Sony Well known AP default channels ------------------------------ 4: Lucent 6: Aironet, Compaq, BreezeNet John

5 5

Streaming: Where are the Slides?
by PJ 11 Feb '03

11 Feb '03

I was curious if it was possible to ask the excellent videographers at the NANOG conference to re-enable the slides over the Real Audio videostream. The slides were visible yesterday, but today they are not. Much of what the speakers say refer to the slides. More importantly it's much more useful using the video channel to see the slides than to seeing images of the speaker. Thanks for anything that can be done about this before the tutorials are over, and thanks for the awesome streaming job. Video and audio has been coming in great in Florida. pj __________________________________________________ Do you Yahoo!? Yahoo! Shopping - Send Flowers for Valentine's Day http://shopping.yahoo.com

3 2