March 2003 - Test - lists.nanog.org

OpenSSL
by Len Rose 18 Mar '03

18 Mar '03

More OpenSSL (and SSH) fun. http://lists.netsys.com/pipermail/full-disclosure/2003-March/004524.html AND http://lists.netsys.com/pipermail/full-disclosure/2003-March/004529.html

3 3

RE: Nortel SHASTA
by Alan Sato 17 Mar '03

17 Mar '03

I use this product. I think they still sell this product especially in dsl enviroments. Good for the pptp and ppoe stuff. Alan You can contact me directly at asato(a)altrio.net. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: Monday, March 17, 2003 11:01 AM To: nanog(a)merit.edu; Gerard White Subject: Re: Nortel SHASTA > > Is there anyone out there in the NANOG community who uses the Nortel SHASTA > box for aggregation that would like to technically chat offline? > Didn´t nortel more or less kill or suffocate the product quite quickly after the aquiring the company? (as they did Promatory) Pete

1 0

New MS and CERT Warning
by Eric Germann 17 Mar '03

17 Mar '03

CERT and MS have posted advisories and patches on a new vulnerability in IIS and Win2K. Particualrly interesting is that it took everyone by surprise (black hats had it first) and they selectively targeted .mil machines. More info on the below URL's. Everyone ready for the latest round of attack mitigation procedures? http://www.msnbc.com/news/886524.asp?0cv=CB10 http://www.cert.org/advisories/CA-2003-09.html http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/ms03-007.asp ========================================================================== Eric Germann CCTec ekgermann(a)cctec.com Van Wert OH 45801 http://www.cctec.com Ph: 419 968 2640 Fax: 603 825 5893 "The fact that there are actually ways of knowing and characterizing the extent of one’s ignorance, while still remaining ignorant, may ultimately be more interesting and useful to people than Yarkovsky" -- Jon Giorgini of NASA’s Jet Propulsion Laboratory

1 0

Re: OpenSSL
by Stewart, William C (Bill), SALES 17 Mar '03

17 Mar '03

Steve Bellovin wrote: > The only caveat is that their attack currently works on LANs, not WANs, > because they need more precise timing than is generally feasible over the Internet. On the other hand, many of the SSL servers on the web are located in hosting centers, which are LAN-connected to potential attackers who can get accounts on machines in the same hosting centers. The attackers' and targets' servers tend to have routers in front of them, as well as the switches provided by the hosting center, but it's still much more precise than the open net.

1 0

Nortel SHASTA
by Gerard White 17 Mar '03

17 Mar '03

Greetings. Is there anyone out there in the NANOG community who uses the Nortel SHASTA box for aggregation that would like to technically chat offline? Regards, Gerard White Aliant

2 1

RE: Controlling outbound traffic in a multihomed BGP environment
by Ejay Hire 17 Mar '03

17 Mar '03

Routing based on source address is called "Policy Routing". IF you are on a cisco box, create an extended access-list specifying the source Ip's, and then match that access list in a route map to set the next hop. Apply the route map on ports facing that customer, building a chain from edge (facing the customer) to border (facing the internet. Good Luck, Ejay -----Original Message----- From: Daniel Abbey [mailto:dabbey@edeltacom.net] Sent: Monday, March 17, 2003 10:20 AM To: nanog(a)merit.edu Cc: cisco-digest(a)groupstudy.com; isp-outsourcing(a)isp-outsourcing.com Subject: FW: Controlling outbound traffic in a multihomed BGP environment How can you control outbound traffic from a single subnet - meaning forcing all its outbound traffic out a single bgp edge router in a multihomed environment. Here is the scenario: 1. Inbound traffic is engineered using prepends - meaning to force inbound traffic through a particular router, we are using prepends to make one path seem better than the other on the outside. 2. Local preferences are set to control general outbound traffic to specific ISPs - those that are one or two hops away. 3. Now, I have a customer whose traffic I'll prefer to force out a single bgp edge router - all his traffic, no specific ones. The IGP is OSPF, and there are several different distribution routers between the access IGP router and the core/edge bgp routers.

1 0

FW: Controlling outbound traffic in a multihomed BGP environment
by Daniel Abbey 17 Mar '03

17 Mar '03

How can you control outbound traffic from a single subnet - meaning forcing all its outbound traffic out a single bgp edge router in a multihomed environment. Here is the scenario: 1. Inbound traffic is engineered using prepends - meaning to force inbound traffic through a particular router, we are using prepends to make one path seem better than the other on the outside. 2. Local preferences are set to control general outbound traffic to specific ISPs - those that are one or two hops away. 3. Now, I have a customer whose traffic I'll prefer to force out a single bgp edge router - all his traffic, no specific ones. The IGP is OSPF, and there are several different distribution routers between the access IGP router and the core/edge bgp routers.

1 0

Re: Issue with 208.192.0.0/8 - 208.196.93.0/24?
by Dr. Jeffrey Race 17 Mar '03

17 Mar '03

On Mon, 10 Mar 2003 19:14:07 -0800, chuck goolsbee wrote: >Forgive the intrusion... Forgiven >We have a customer who uses some merchant services off of >208.196.93.204, which seems to be unreachable via any location I try. >Emails to UUnet's NOC are unaswered and the guy I talked to on the >phone @ UU wouldn't open a ticket because I'm not a customer (but his >traces were dying in the same place as mine: > >207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185)) > >Can anybody out there hit that IP (208.196.93.204) at the moment? Or >indeed much of anything in that /8 [C:\]ping 208.196.93.204 PING 208.196.93.204: 56 data bytes ----208.196.93.204 PING Statistics---- 7 packets transmitted, 0 packets received, 100% packet loss [C:\]tracerte 208.196.93.204 0 192.168.1.1 (192.168.1.1) 0 ms 0 ms 0 ms 1 192.168.1.1 (192.168.1.1) 0 ms 0 ms 8 ms 2 10.20.12.9 (10.20.12.9) 55 ms 55 ms 55 ms 3 ppp-203.144.161.5.revip.asianet.co.th (203.144.161.5) 39 ms 5 4 ppp-203.144.144.157.revip.asianet.co.th (203.144.144.157) 54 m ms 5 ppp-203.144.144.2.revip.asianet.co.th (203.144.144.2) 242 ms s 6 211.180.13.225 (211.180.13.225) 133 ms 133 ms 125 ms 7 210.120.192.136 (210.120.192.136) 133 ms 133 ms 132 ms 8 203.255.234.198 (203.255.234.198) 258 ms 203.255.234.210 (203. 266 ms 203.255.234.198 (203.255.234.198) 266 ms 9 203.255.234.36 (203.255.234.36) 250 ms 258 ms 258 ms 10 67.104.60.49 (67.104.60.49) 258 ms 258 ms 281 ms 11 p4-3-0.MAR2.Fremont-CA.us.xo.net (207.88.80.13) 258 ms 258 12 p4-0-0.RAR2.SanJose-CA.us.xo.net (65.106.5.137) 273 ms 266 13 p0-0-0-1.RAR1.SanJose-CA.us.xo.net (65.106.1.65) 266 ms 281 14 p0-0.IR1.PaloAlto-CA.us.xo.net (65.106.5.194) 273 ms 336 ms 15 206.111.12.150 (206.111.12.150) 265 ms 266 ms 258 ms 16 157.at-5-1-0.XR1.SAC1.ALTER.NET (152.63.51.58) 1031 ms 273 17 0.so-0-1-0.XL1.SAC1.ALTER.NET (152.63.53.241) 266 ms * 281 18 0.so-3-0-0.TL1.SAC1.ALTER.NET (152.63.53.250) 273 ms 274 ms 19 0.so-1-2-0.TL1.NYC9.ALTER.NET (152.63.10.77) 352 ms 335 ms 20 0.so-3-0-0.XL1.NYC1.ALTER.NET (152.63.27.29) 321 ms 321 ms 21 0.so-0-0-0.XR1.NYC1.ALTER.NET (152.63.19.85) 336 ms 336 ms 22 207.ATM6-0.GW11.NYC1.ALTER.NET (152.63.29.185) 360 ms 352 m 23 * * * 24 * [dies] [C:\]host 208.196.93.204 208.196.93.204 = ecobeauty.org Jeffrey Race

6 5

Re: [Fwd: FC: Email a RoadRunner address, get scanned by their
by jlewis＠lewis.org 17 Mar '03

17 Mar '03

I got the following personal message from Mark Herrick of rr.com (which I'm passing along with his permission/request). I hope (and I think he hopes) that by passing it along, some questions can be answered and misunderstandings explained. In an additional message, he answered my question of "how does rr.com security define 'network owner'?" with the following URL. http://security.rr.com/subdelegation.htm So as long as space is swipped or documented in a publicly accessible rwhois server, if you're a contact for the IP block, you should be accepted as the 'network owner'. BTW...for the time being, rr.com has stopped SMTP relay testing and is focusing entirely on finding and blocking mail from open proxies that have been used to spam their customers. ---------- Forwarded message ---------- Date: Sun, 16 Mar 2003 12:56:30 -0500 From: "W. Mark Herrick, Jr." <markh(a)va.rr.com> To: jlewis(a)lewis.org Subject: Re: Your NANOG post Hi Jon, I was pointed to the thread on NANOG through another person, and I saw your post on the Merit website (below). As I'm not subscribed to NANOG, and unfortunately I am prohibited (from a time resource standpoint, not administratively) from subscribing to that list at this time, but I thought that I'd comment on your post specifically, since it touched on more than one area. If you are so included, feel free to pass this along to NANOG, with my regards. So, just to set one ground rule here - we're talking about proxy and relay testing, not full-out penetration testing. With that in mind... To directly answer your first paragraph, you are absolutely correct - we have absolutely NO objection to open proxy or relay scanning of IP addresses from a system that either: 1. Has spam in hand (a la MAPS RSS). 2. Has received a direct connection from our subscriber IP address or SMTP server (a la AOL, Outblaze). That being said, we have, and will continue to have, a severe issue with so-called 'scanning services', that *proactively* scan IP addresses (e.g., DSBL), or services that accept requests from anywhere to perform 'on-demand' scans (e.g., hatcheck.org) without first requiring (and keeping on hand) proof (e.g., spam-in-hand) that the IP address is a source of spam, open to third party relay, or has an open proxy service. At no time has Road Runner performed any PROACTIVE scanning on any IP address that does not belong to Road Runner. Furthermore, we perform no REACTIVE scanning unless it meets one of the above criteria, and in addition, regardless of whether or not there has EVER been an issue with the network, we will not REACTIVELY scan ANY IP address when there is a request from the *network owner* that we do not do so. We have no wish to be abusive, and as such, we limit scans of an IP to one per week. This is all clearly explained at http://security.rr.com. You brought up another issue, which I *think* may be pointing to an argument that I had with Ron Guilmette some time ago, when his service was performing relay scans on our IP space or some such. I am fairly certain that this argument took place because I viewed Ron's scans to be proactive in nature. Our stance on proactive scanning has not changed in the 5 years that I have been with Road Runner. Anyways, as far as your last statement - since the inception of our scanning initiative (1st week in January), we have identified over 50,000 open proxy servers. The problem is big, it's only getting bigger, and it's not going to go away, unfortunately. Best, Mark Herrick Director - Operations Security Road Runner

2 1

RE: OT: Increasing Cell Phone Signal inside a NOC?
by Huopio Kauto 16 Mar '03

16 Mar '03

In Finland, it is very usual that cell providers can bring a mini-cell (_not_ a repeater, a real cell) _in_ to the building and wire all floors and especially facilities that are below ground level. In my previous life, I got a cell provider to install an extension to the in-house antenna network to a previously unused area of the basement when we decided to build a new machine room there. Full coverage indeed. :) Well, Helsinki is a city where even the metro system has 100% coverage from all four network operators :) Just call your cell operator customer service and ask for someone who is able to talk about coverage issues. --Kauto

4 3