May 2003 - Test - lists.nanog.org

RE: Pro bono projects?
by McBurnett, Jim 06 May '03

06 May '03

Hey check with the Rob Thomas over at Team CYMRU He might be able to use some routers and such... http://www.cymru.com J >-----Original Message----- >From: Deepak Jain [mailto:deepak@ai.net] >Sent: Tuesday, May 06, 2003 4:30 PM >To: Nanog@Merit. Edu >Subject: Pro bono projects? > > > > >Are there any good places a service-network could donate resources >(bandwidth/servers/routing tables/what have you/etc) to >for-the-good-of-the-net projects? > >This sort of thing used to be quite a bit more prevalent and I >wanted to >know if there are any clear needs in this area. > >Thanks, > >Deepak Jain >AiNET > >

3 2

Pro bono projects?
by Deepak Jain 06 May '03

06 May '03

Are there any good places a service-network could donate resources (bandwidth/servers/routing tables/what have you/etc) to for-the-good-of-the-net projects? This sort of thing used to be quite a bit more prevalent and I wanted to know if there are any clear needs in this area. Thanks, Deepak Jain AiNET

4 3

Re: Re[2]: The in-your-face hijacking example, was: Re: Who is announcing bogons?
by emil＠atrivo.com 06 May '03

06 May '03

Hello, It's pretty disheartening to see the way this situation was dealt with. To this day as I am writing this e-mail I have not received any phone calls or even e-mails on what was done wrong and how it should be handled. Everything was done behind our backs by the people that have the power to cause problems knowing that I will have no recourse. It takes a few seconds to place a phone call and give guidance on the situation. Especially by the likes of HE which we have given business to and continue to give business to. Well I guess that there is no point in going on with this topic. Officially I am declaring surrender and victory to the people that have chosen to cause so much harm. Would like to thank all of you that have given support and e-mailed me with how to obtain correct allocation from ARIN. And the wheels are already in motion and will be completed next week. Hopefully Atrivo and myself are not blacklisted in this group, since we caused nobody any harm. We did follow all the guidelines that Arin has put in place, but now it's my understanding that due to our size only a direct allocation makes any sense. Thanks and let's all try to help each other and not go against each other. It will make our lives just that much easier! Atrivo - Web Innovation Emil Kacperski Phone: 925-550-3947 E-mail: emil(a)atrivo.com ICQ: 23531098

7 11

Reply to Sean Donelan (was: Yet more hijacked space? - deru.net)
by Michael.Dillon＠radianz.com 06 May '03

06 May '03

>But it doesn't answer the basic questions. How do you tell the difference >between a legitimate change and an illegitmate change? If ARIN makes it >extremely difficult to update registry records, the records will get even >more out of date. On the other hand if ARIN makes it too easy to update >registry records, the wrong people can make unauthorized changes. That's a good question, Sean. However there is another way. ARIN and the other RIRs need to stop publishing the whois directories as they stand today. There is no good reason for publishing most of the information that they do publish. All of this garbage information clogs up the system and makes it easier for spammers and outlaws to hide. The Internet is no longer a collegial project where we can request that all people with a directory on an ARPANET host who is capable of passing traffic across the ARPANET should be registered in the whois directory. (Ref RFC 812) In fact, we haven't done this for at least 10 years. We already have a two-tiered system in place where the bulk of users with directories on an Internet-connected system capable of initiating Internet traffic are only registered with their service provider. Only network operators are expected to register in the whois directory. I think that it is time to tighten up on these requirements even further. The published whois directory should only contain the up-to-date contact information of people responsible for enforcing network AUPs and rooting out network abuse. If an organization is allocated or assigned IP space from their upstream then their info should not be published in the whois directory unless they agree to be directly responsible for AUPs and abuse mitigation. This contact information should be checked more than once per year (twice yearly or quarterly) and if it becomes stale, then it should be immediately updated to indicate that it is stale. The incorrect phone numbers and email domains should be removed from the published directory. If there is an upstream then the address contact info should revert to the upstream since it is not possible for a non-contactible entity to be responsible for AUP enforcement and abuse mitigation. In the case of address blocks allocated directly by a registry, this means they must virtually disappear from the whois. The only information left will be "Previously allocated, no current contact info". In one fell swoop, this will enable people to block just about every possible source of spam. If anyone is actually still using their addresses, this will also bring them out of the woodwork to update their contact info and get with the program. There will be zero impact on anyone who gets their addresses from an upstream since the contact info will revert to the upstream until such time as the upstream fomrally delegates the abuse handling responsibility to the customer by submitting correct contact info. Of course, none of this will happen unless network operators stop chasing symptoms and start thinking more deeply about the roots of the problem. One of these roots is the lack of a web of accountability for IP address space. --Michael Dillon

5 5

Re: Reply to Sean Donelan (was: Yet more hijacked space? - deru.net)
by Michael.Dillon＠radianz.com 06 May '03

06 May '03

>> I think that it is time to tighten up on these requirements even further. >> The published whois directory should only contain the up-to-date contact >> information of people responsible for enforcing network AUPs and rooting >> out network abuse. If an organization is allocated or assigned IP space >> from their upstream then their info should not be published in the whois >> directory unless they agree to be directly responsible for AUPs and abuse >> mitigation. >This would make every provider like >Level3 and Cogent...hosters of spammers camouflaged by a lack of >publicly available reassignment data. At least with the current system, >most providers publish reassignment data, so when you get spammed by >discountdeals or ultimate savings, or the like, you can usually look up >their address space and block them. If Level3 and Cogent are in a common carrier position in relation to their customers then it is likely that they will delegate the responsibility for AUPs and abuse issues to the customer. In that case they will provide current and functional contact info to the whois directory much like today. One difference is that someone (hopefully the publisher of the whois directory) will take responsibility for regularly confirming that contact info. If the info gets out of date then they would pester Level3 or Cogent for an update and if Level3 or Cogent don't supply updated contact info then the whois directory would revert to showing Level3 or Cogent as responsible for the block. Now, back to your idea of blocking address space. Is there anything in the above suggestion that makes it impossible for you to block incoming email from abusive address space? >Too many providers just don't care >about spam as long as the spammers pay. If my suggestion were adopted then the spammer's provider would either enforce their own AUPs or they themselves would pay the price. >> In one fell swoop, this will enable people to block just about every >> possible source of spam. >I assume you mean it would make blocking bogons and unused blocks easier, >but I think the net result would be to make it much harder to block most >sources of spam. No, I mean that all IP address would be clearly delineated into two types. Prime addresses would have correct and functional contact info while dirty addresses would not. If you were advising a business on their Internet connectivity would you advise them to sign up with a provider using prime addresses or dirty addresses? It also means that there would be two strategies for dealing with SPAM, DDOS, etc. If it comes in from a dirty address, then just block or filter the traffic. If it comes from a prime address, then you contact the provider and work out the problem. There isn't any more huge grey area of providers who might be good people if only you could find some way to contact them. Any provider who doesn't keep their contact information up to date ends up in the same ditch as the dead dogs, offal and sewage. >So you want to fix this by making it even harder to find out who's using >an IP block? No, I want to shift the responsibility onto the IP block users. It should be their responsibility to show that they are a good network citizen or else they won't get connectivity. By the way, I think that something like this can be done entirely outside of the existing RIR and whois structures. This is all about a web of trust and it is possible to set up a private SMTP exchange system that requires its members to only accept incoming SMTP (on a port other than 25) from organizations who enforce a no-spam AUP. Then you can sign up for Internet email service from one of the members and onlly see SPAM once in a blue moon. --Michael Dillon P.S. about the crack pipe, I was under the impression that crack smoking reduced your ability for creative thought. In that case it's more likely that those who oppose my ideas are the ones smoking crack...

1 0

RE: Pakistan government orders ISP service level agreement
by Drew Weaver 05 May '03

05 May '03

On a lighter note, who is going to IRAQ with me to deploy a Motorola Canopy 5.8Ghz WLAN network? :p -Drew -----Original Message----- From: Daniel Golding [mailto:dgold@FDFNet.Net] Sent: Monday, May 05, 2003 4:09 PM To: Sean Donelan Cc: nanog(a)merit.edu Subject: Re: Pakistan government orders ISP service level agreement Well, we can rest easy with the Paki Telecomunications Ministry on the case. They'll have this whole DDOS thing wrapped up in no time. right? :) - Dan On Mon, 5 May 2003, Sean Donelan wrote: > > Pakistan has been suffering a 40 day DOS attack, disrupting most of the > International Internet service in the country. > > The Pakistan Government, Minister for IT & Telecom, has "directed" the > Pakistan Telecommunications Corporation to sign service level agreements > to ensure 99% Internet availability. > > Over 200 official(government?) websites have been inaccessible for over > three weeks. > > http://www.paknews.com/main.php?id=5&date1=2003-05-05 > "Within a period of five days, the body has been assigned to formulate > a concrete strategy to stem the incidence of DoS attacks.. The > committee will work on urgent basis and suggest short-term measures > within two day." > > > > >

2 1

Re: Pakistan government orders ISP service level agreement
by Daniel Senie 05 May '03

05 May '03

At 01:53 PM 5/5/2003, Christopher L. Morrow wrote: >On Mon, 5 May 2003, Sean Donelan wrote: > > > > > Pakistan has been suffering a 40 day DOS attack, disrupting most of the > > International Internet service in the country. > > > > The Pakistan Government, Minister for IT & Telecom, has "directed" the > > Pakistan Telecommunications Corporation to sign service level agreements > > to ensure 99% Internet availability. > > > > Over 200 official(government?) websites have been inaccessible for over > > three weeks. > > > > http://www.paknews.com/main.php?id=5&date1=2003-05-05 > > "Within a period of five days, the body has been assigned to formulate > > a concrete strategy to stem the incidence of DoS attacks.. The > > committee will work on urgent basis and suggest short-term measures > > within two day." > > > >I suppose contacting upstreams for traceback and filtration isn't >something they want to do?? Wasn't clear to me whether their DoS problems were from within or from outside. If from outside, they certainly SHOULD think about asking for help from their upstream(s).

1 0

Re: Class "B" IP BLOCK
by ddragon＠hushmail.com 05 May '03

05 May '03

> Hmm, while we're at it, what relationship do you have with > Erie Forge and Steel, other than squatting on some of their > address space. > > Perhaps 146.20.0.0/16 is another example of hijacked address > space. Perhaps you should learn the facts, before getting your stalk on and contributing to this off-topic witch hunt. Once upon a time, enterprises like Erie Forge were assigned class B's of IP space. As a technologically progressive organization, Erie seized the opportunity, and emerged as one of the first in the steel industry to have most of their terminals, servers, printers, and even casting equipment connected to the Internet. Over the years, technology and operational practices evolved. No longer does one need massive provider-independent space to connect to the Internet; for many small to medium sized businesses, a simple application proxy or NAT box and internal address space is adequate. Despite your baseless claims to the contrary, the Information Technology staff of Erie Forge and Steel is well aware, and approving, of the current usage of their IP space. What you consider "hijacking", they consider innovation, and an opportunity to give back to the Internet community that's allowed them to prosper over the years. Getting down to business, I have three larger concerns with the style and content of your posting. One, the NANOG AUP (http://www.nanog.org/aup.html) clearly states: "7. Postings to the list must be made using real, identifiable names and addresses, rather than aliases." With that in mind, I respectfully ask that Susan Harris and the NANOG moderators require that you come into compliance with their policy, and boot you off the list post-haste, should you fail to do so. I'm appalled that you would even begin to point out shortcomings in others, when you've neglected to follow such simple rules of decency yourself. Second, could you please do something about the high volume of spam originating from and/or referencing your network? You must be too clueless to take any action, or black hat spam heaven (if not a spammer yourself, for letting this go on under your watch), from the gist of the postings I've read. Kai Schlichting and the gentlemen on SPAM-L and NANAE will be able to cooberate these reports. http://groups.google.com/groups?q=RCN+spam&hl=en&lr=&ie=UTF-8&sa=N&tab=wg Third, can you explain to me the following: EnterAct EACT-ROUTERS-03 (NET-207-229-159-44-1) 207.229.159.44 - 207.229.159.51 EnterAct EACT-ROUTERS-02 (NET-207-229-159-20-1) 207.229.159.20 - 207.229.159.39 EnterAct EACT-VHOST-NT03 (NET-207-229-159-52-1) 207.229.159.52 - 207.229.159.255 EnterAct EACT-CUST-NERGE (NET-207-229-166-224-1) 207.229.166.224 - 207.229.166.239 EnterAct EACT-APM-TS01 (NET-216-80-19-0-1) 216.80.19.0 - 216.80.19.31 EnterAct EACT-APM-COLO01 (NET-216-80-19-32-1) 216.80.19.32 - 216.80.19.47 EnterAct EACT-APM-SERVERS01 (NET-216-80-19-48-1) 216.80.19.48 - 216.80.19.63 EnterAct EACT-CUST-EADSL (NET-216-80-31-88-1) 216.80.31.88 - 216.80.31.95 EnterAct EACT-CUST-DSL-01 (NET-216-80-0-0-2) 216.80.0.0 - 216.80.0.223 These prefixes belonging to "EnterAct" are advertised by RCN. Are they illlegal customer advertisements, or are you just too clueless to update their SWIP records in accordiance with the same ARIN policy you wish to see applied to others, now that RCN has acquired EnterAct? Perhaps we all should filter them now, and ask questions and carry out an investigation later? I hope Rob Thomas is taking note, I'm sure these are not only bogons, but violate some secret RFC (yeah dude, that's the ticket) documenting reversed IP space. Wait, that's not all. I see you have mail servers inside: OrgName: GweepCo Cooperative Network OrgID: GCN-1 Address: 15 Lee Street Suite 1 Address: Worcester MA, 01609 City: StateProv: PostalCode: Country: US NetRange: 204.145.148.0 - 204.145.148.255 CIDR: 204.145.148.0/24 NetName: GWEEP-NET NetHandle: NET-204-145-148-0-1 Parent: NET-204-0-0-0-0 NetType: Direct Assignment NameServer: SIDEHACK.SAT.GWEEP.NET NameServer: DNS.GWEEP.CA NameServer: SNMP.HEATHROWCABLE.NET Comment: RegDate: 1995-01-09 Updated: 2002-11-27 TechHandle: JZP-ARIN TechName: Provo, Joseph Z. TechPhone: +1-508-229-0037 TechEmail: jprovo-arin(a)rsuc.gweep.net But "GweepCo" (Is this even a real company? Can you provide any articles of organization and incorporation?) has a domain registration which lists as the address: GweepCo Cooperative Network (GWEEP-DOM) 35 William Street, Suite 3D null Domain Name: GWEEP.NET Administrative Contact: Petrarca, Andrew (AP200) android(a)GWEEP.NET GweepCo Cooperative Network 565 Quaker Lane, Unit 135 West Warwick, RI 02893 and Subdomain: gweep.ca Renewal-Date: 2004/05/02 Date-Approved: 2000/10/18 Date-Modified: 2003/03/12 Organization: Gweep Systems Description: Unix and Internet consulting. BC registration #15267493. Admin-Name: Brian Edmonds Admin-Title: Trouble Consultant Admin-Postal: 2907-198 Aquarius Mews Vancouver BC V6Z 2Y4 Canada Admin-Phone: +1 (604) 662-8304 Admin-Fax: Admin-Mailbox: brian(a)gweep.ca Tech-Name: Brian Edmonds Tech-Title: Trouble Consultant Tech-Postal: Gweep Systems 2907-198 Aquarius Mews Vancouver BC V6Z 2Y4 Canada Tech-Phone: +1 (604) 662-8304 Mass, Rhode Island, or Canada? Which will it be? Can you make up your mind please? Or get some IP space you can verify is yours. Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

4 3

RE: Class "B" IP BLOCK
by Dan Lockwood 04 May '03

04 May '03

Rob, Your team is tireless! We all appreciate your hard work! Dan -----Original Message----- From: Rob Thomas [mailto:robt@cymru.com] Sent: Saturday, May 03, 2003 16:54 To: NANOG Subject: Re: Class "B" IP BLOCK Hi, NANOGers. ] of IP addresses which have not been allocated to a RIR, I would think ] policing arin or anybody else's allocations is outside the scope of ] what they'd like to do. Actually we do hope to eventually make available bogon lists based on the unallocated prefixes within the RIR allocations. This will be a separate list due to the more dynamic nature of it. It will use a different community on the bogon route-server as well. I don't have an ETA for that portion of the list, however. Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

2 1

Software catches DDoS and creates ACL's
by bobjohnson61＠netzero.net 04 May '03

04 May '03

I tried this download. Pain to work up a Linux box but it does what they say. Detects DDoS and worm propagation and suggests ACL's. From there site I see there is an auto mode that if implemented at peering points would stop DoS and superworms auto-magically. >From this site: http://www.securityconfig.com/software/networksecurity/floodguard_alert.html "FloodGuard Alert is designed to detect all forms of flooding and bandwidth attacks, including DDoSes and superworms. The software initially trains on ingress traffic directed at your protection domain that it uses to statistically identify anomalous traffic. It also suggests initial mitigation steps (ACLs/filters) that can be taken to stop the attack while letting legitimate traffic through. It comes with a comprehensive Java-based GUI that facilitates traffic visualization, configuration, control, analysis, report generation, and SYSLOG- and email-based communications" Download at www.reactivenetwork.com/downloads Bob Johnson Juno Sys Admin ________________________________________________________________ The best thing to hit the internet in years - NetZero HiSpeed! Surf the web up to FIVE TIMES FASTER! Only $14.95/ month -visit www.netzero.com to sign up today!

1 0