June 2003 - Test - lists.nanog.org

off-topic, contact needed at mac.com
by Eric Brunner-Williams in Portland Maine 10 Jun '03

10 Jun '03

If anyone has an operational contact at mac.com, please drop me a note off-list.

1 1

RE: pool.ntp.org NTP servers
by Ejay Hire 10 Jun '03

10 Jun '03

I was thinking about the not the closest-server problem today, and realized this is a good application for BGP-DNS http://www.enyo.de/fw/software/bgpdns/ Making it possible to look at the reqeustor's network location and retrun the "closest" servers. -Ejay -----Original Message----- From: Curtis Maurand [mailto:curtis@maurand.com] Sent: Thursday, June 05, 2003 10:37 AM To: wayne Cc: nanog(a)merit.edu Subject: Re: pool.ntp.org NTP servers ns1.mainelinesys.com Curtis On Sun, 1 Jun 2003, wayne wrote: > > > > This seems like a good time to put in a plug for the pool.ntp.org NTP > servers. This is collection of public ntp servers provided by > individuals and ISP's placed in a round-robin DNS system. The goal is > to provide the general public with a list of NTP servers that they can > use without abusing the stratum 1 servers. > > > If you can provide an NTP server to the pool, it would be greatly > appreciated. The bandwidth and CPU usage of an NTP server is quite > low so you can easily provide NTP services to hundreds or even > thousands of users. > > If you create default NTP setups and you don't have good default NTP > servers to use, feel free to use pool.ntp.org for one or more of your > NTP sources. (You should have at least 3 NTP sources, although using > more than three doesn't usually help much.) > > > For more information, see: > > http://fortytwo.ch/time/ > > > -wayne > > -- -- Curtis Maurand mailto:curtis@maurand.com http://www.maurand.com

8 8

Bad-ass stress / test tool for IDS, DoS, Firewalls, etc.
by bobjohnson61＠netzero.net 09 Jun '03

09 Jun '03

I got this because I down-loaded from them. This is a very useful hammer for IDS, Firewalls, DoS devices etc. "The toolkit created to generate huge loads against test servers for product development is for sale. It is called i408, and can generate up to 1000 concurrent two-way HTML connections per box from real IP addresses in real time from real HTTP logs. Use it to stress and test your firewalls, IDS, load balancers, routers, switches, servers, cache appliances and get detailed performance metrics such as response time, ingress and egress rates, successful and unsuccessful GETs per second. A competitive professional tool to do this costs more than $40,000. $250 per seat per server for 6 months is cheap insurance that your devices do what they claim. See http://www.reactivenetwork.com/i408" I heard that DDoS deliberate attack tools are included if you ask. ________________________________________________________________ The best thing to hit the internet in years - NetZero HiSpeed! Surf the web up to FIVE TIMES FASTER! Only $14.95/ month -visit www.netzero.com to sign up today!

2 1

Senate hearing: Personal and National Security Risks of P2P
by Sean Donelan 09 Jun '03

09 Jun '03

Interesting title. Has anyone heard who is on the witness list? http://judiciary.senate.gov/hearing.cfm?id=801 The Senate Committee on the Judiciary will hold a hearing on Wednesday, June 11, 2003, at 2:00 p.m. in Room 226 of the Senate Dirksen Building, on "The Dark Side of a Bright Idea: Could Personal and National Security Risks Compromise the Potential of P2P File-Sharing Networks?"

2 1

NYC: TelX vs. Telehouse
by Charles Sprickman 09 Jun '03

09 Jun '03

Hello, Looking for people who have used both and can offer some comparisons. I'm somewhat familiar with Telehouse's plusses and minuses. TelX also claims that they will have a service soon that will link both locations, but I'm not sure exactly what that means; a link to NYIIX? I'm mainly curious about the variety of transit providers (both seem a bit slim), how hard it is to get sublet customers in, and the reliability of power/cooling. We're currently at Level3, and their x-connect fees are making a number of projects too expensive. I can summarize offlist replies if that's preferred. Thanks, Charles -- Charles Sprickman spork(a)inch.com

1 1

RE: Ettiquette and rules regarding Hijacked ASN's or IP space?
by Christopher L. Morrow 09 Jun '03

09 Jun '03

On Mon, 9 Jun 2003, Michel Py wrote: > Chris, > > > Christopher L. Morrow wrote: > > So, for an example, if I steal ASN 8143 (already stolen so its > > mute) and I'm 'a good guy', all I want to do is run a network > > no spam/abuse eminates from it, > > Question: if you are a 'good guy', why didn't you request your own legit > ASN in the first place? It's less work than finding one to hijack and > hijack it. And probably cheaper too: $500 does not pay for much of my or > your time. excellent point :) the distinction between 'good' and 'bad' was just non-abuser/abuser. Certianly ARIN's requirements for ASN ownership are simple enough, be multihomed and have a 'unique' routing policy. If you need an ASN likely you are already multihomed and have a 'unique' routing policy, eh? > > > > I am not advocating one or the other, and to me the rules should > > apply to both groups (all theives treated equally)... I'm just > > curious as to the general thought on this subject. > > Without taking sides, does the first group really exist? > If you fuzz over the 'bad'/'good' beyond 'abuser'/'non-abuser' then perhaps there isn't a distinction. Perhaps clarification: Someone that sets up an ISP and hijacks ASN/ip-blocks specifically to abuse versus someone who hijacked an ASN to avoid paperwork. The distinction isn't necessarily for any real purpose, except as a talking point. I've seen both groups get discussed, and only the 'abusing' group seems to get hounded... or atleast thats what I've seen.

4 3

RE: Ettiquette and rules regarding Hijacked ASN's or IP space?
by Christopher L. Morrow 09 Jun '03

09 Jun '03

On Mon, 9 Jun 2003, Michel Py wrote: > Chris, > > > Christopher L. Morrow wrote: > > excellent point :) the distinction between 'good' and 'bad' was > > just non-abuser/abuser. Certianly ARIN's requirements for ASN > > ownership are simple enough, be multihomed and have a 'unique' > > routing policy. If you need an ASN likely you are already > > multihomed and have a 'unique' routing policy, eh? > > Yep. > > > > If you fuzz over the 'bad'/'good' beyond 'abuser'/'non-abuser' > > then perhaps there isn't a distinction. Perhaps clarification: > > Someone that sets up an ISP and hijacks ASN/ip-blocks > > specifically to abuse versus someone who hijacked an ASN to > > avoid paperwork. > > I'm not buying into this "avoid paperwork" thing. I can't speak for > RIPE, APNIC or LACNIC, but in the ARIN region I have requested ASNs both > for myself and helped customers request theirs and it's not that big of > a deal. Note that I didn't say it was a 'good' reason, just a reason... that or 'status' to have an ASN below number N (like say 10,000??) not that it matters to the routing system WHAT your ASN might be, just that one exists... > > There is no real money incentive either: if one is setting up a real > ISP, a one-time $500 fee is a) part of the cost of doing business and b) > well worth the money compared to be labeled as a hijacker. > indeed... some people are shortsighted perhaps? Again, I don't understand the mentality so I can't argue for it... > Save for network engineers that have snagged an ASN from a merge and > recycled it for their home network or pet project (there are none on > this list, of course), would you mind giving some specifics about 'good > guys' that have hijacked an ASN?

1 0

Black box that allows just an A or B DC feed
by james 09 Jun '03

09 Jun '03

I have a device that only has one DC power input. Is there a box that can accept an A & B DC leg, keep both isolated, & and feed my device with just A or B ? ie, if the A or B leg fails at the co-lo this blackbox will switch to what ever leg is up. Quickly, I hope ! Or are there other ways to solve this issue ? James Edwards Routing and Security Administrator jamesh(a)cybermesa.com At the Santa Fe Office: Internet at Cyber Mesa Store hours: 9-6 Monday through Friday Phone support 365 days till 10 pm via the Santa Fe office: 505-988-9200 or Toll Free: 888-988-2700

3 3

Re: Full Internet ASN <--> AS Name resolution
by Martin J. Levy 08 Jun '03

08 Jun '03

Mourad, Don't forget LACNIC... ftp://ftp.lacnic.net/pub/stats/lacnic/ ftp://ftp.lacnic.net/pub/stats/lacnic/lacnic.20030601 Martin --- At 04:00 PM 6/6/2003 +0200, Mourad BERKANE wrote: > >Hi NANOGers, > >Could someone forward me a .txt file including FULL INTERNET (ARIN + RIPE + APNIC) ASN <--> AS Name resolution table? > >I don't want to compile following regional dbase :-) > >ftp://ftp.arin.net/netinfo/asn.txt >ftp://ftp.apnic.net/pub/apnic/dbase/data/rpsl >ftp://ftp.ripe.net/ripe/dbase/ > >Thanks in advance >Mourad >

6 6

DDoS tracking / accounting tools
by Mike Tancsa 08 Jun '03

08 Jun '03

It appears someone started a DDoS (~ 500 hosts involved) attack against a customer IP in our network this morning at 6am EDT (~ 250Mb/s coming in on 3 links). None of the IP addresses are spoofed as there is a fixed set of about 500 hundred and all are coming in via paths that make sense from a bgp perspective. Also doing a quick sample of the ones still blasting at me across my private peers that have not null routed the /32 its clear that they are still pushing out packets as quick as possible judging by response times from those hosts. I now want to contact the individual network abuse departments of said networks so that they can take appropriate action against the 'owned' hosts involved. Does anyone know of or have a tool that can quickly take a list of IP addresses and summarize / generate the appropriate network contact info ? What about a tool to quickly summarize by AS ? Doing a quick random sample of the hosts involved 6 out of 10 were all windows type boxes and 4 had no ports open or were either firewalled or behind some home router. The boxes all seem to be blasting out packets 445 bytes long and the protocol appears to be randomized in the header 09:35:57.243330 0:a:f3:a5:c8:bc 0:d0:b7:27:55:43 ip 459: 211.135.33.199 > 64.7.138.8: ip-proto-253 425 (ttl 109, id 9477, len 445) 0x0000 4500 01bd 2505 0000 6dfd 66e1 d387 21c7 E...%...m.f...!. 0x0010 4007 8a08 0000 0000 0000 0000 0000 0000 @............... 0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0050 0000 and .. 18:23:59.553908 0:4:de:56:d:80 0:1:80:38:46:37 ip 459: h24-77-1-84.gv.shawcable.net > 64.7.138.8: icmp: echo reply 0x0000 4500 01bd 74e3 0000 7801 e8ac 184d 0154 E...t...x....M.T 0x0010 4007 8a08 0000 0000 0000 0000 0000 0000 @............... 0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0040 0000 0000 0000 0000 0000 0000 0000 0000 ................ 18:28:32.069714 0:4:de:56:d:80 0:1:80:38:46:37 0800 459: 24.77.1.84 > 64.7.138.8: truncated-udplength 0 (ttl 120, id 15668, len 44 5) 0x0000 4500 01bd 3d34 0000 7811 204c 184d 0154 E...=4..x..L.M.T 0x0010 4007 8a08 0000 0000 0000 0000 0000 0000 @............... 0x0020 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0x0030 0000 0000 0000 0000 0000 0000 0000 0000 ................ Anyone recognize this DOS signature ? trinity v3 seems to have these capabilities but I have not seen it mentioned in some time... An oldie but a goodie, or something new ? ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

1 0