June 2003 - Test - lists.nanog.org

Internet Surveillance and Infrastructure Protection
by Sean Donelan 01 Jun '03

01 Jun '03

Did anyone attend the Telestrategies conference on Internet Surveillance and Infrastructure Protection on May 29-30 2003? http://www.telestrategies.com/internet_surveillance/index.html Internet Surveillance and Infrastructure Protection This keynote session frames the problem facing the Department of Homeland Security, Telecommunications Service Providers, Corporate IT Managers and others regarding lawfully authorized Internet surveillance and infrastructure protection. It addresses why IP surveillance and intelligence gathering is a challenging problem, how to address surveillance and infrastructure protection together, what are service providers, law enforcement officials and corporate user options to protect IP infrastructure, ROI considerations for service providers and more Did any of the speakers say anything interesting at the conference?

1 0

Re: SLC Sheraton wireless
by Steven M. Bellovin 01 Jun '03

01 Jun '03

In message <20030601201141.GA4142(a)security.hp.com>, LaMont Jones writes: >On Sun, Jun 01, 2003 at 04:05:47PM -0400, Steven M. Bellovin wrote: >> I'm in the lobby; it just worked. > >Sitting in the BGP multihoming tutorial - First try had me associated with >something with an SSID of STSN-conf, which (at least then) didn't do squat >for getting out, although it happily gave me a 10.64/16 IP with DHCP. > >Changing the SSID to nanog28 made life much happier... > Ah, STSN. I've had to hack dhclient because some of their servers (encountered often in Marriotts) emit options that are sufficiently invalid to cause dhclient to discard the packets. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

2 1

Re: SLC Sheraton wireless
by Steven M. Bellovin 01 Jun '03

01 Jun '03

In message <20030601165108.2C86D5E55E(a)segue.merit.edu>, "Rodney Joffe" writes: > >Is there a trick to the wireless connectivity in the hotel? Or limited coverag >e/blackholes? > I'm in the lobby; it just worked. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

2 1

Net-24 top prefix generating bogus RFC-1918 queries
by John Brown 01 Jun '03

01 Jun '03

Operators within Net-24 (typically Cable Operators) would do good in setting up a AS112 anycasted DNS server within their networks. Cable modem users tyically NAT their connections to allow multiple machines at home to be "online". This causes local hosts to generate junk traffic towards the global internet when these machines query for or try DynaDNS updates on RFC-1918 addresses. In a 100,000 query sample (lasted for 30 seconds) we saw 768 unique Net-24 prefixes. All of them had multiple queries within the sample period. Looking at the raw data, we saw 7444 queries out of 100,000 queries from Net-24 prefixes. Given this, each Net-24 query, on average, asked for info 10 times within the 30 sec sample window. All of this is from a AS112 server located in NM that is announcing the AS112 prefix towards our transit provider AS 1239. If you are not aware of the AS112 project you should look at : http://www.as112.net Site maintained by Paul Vixie My setup tips page: http://www.chagreslabs.net/jmbrown/research/as112/index.html Based on a 1,000,000 query (2 min period of time) here are the top 20 /8's that gen bogus queries for RFC-1918 related DNS data. 61637 24.0.0.0 51596 65.0.0.0 36974 216.0.0.0 32925 63.0.0.0 31503 66.0.0.0 31483 208.0.0.0 30760 217.0.0.0 25813 168.0.0.0 25538 151.0.0.0 25300 209.0.0.0 19862 200.0.0.0 19375 68.0.0.0 17568 207.0.0.0 17303 80.0.0.0 16585 141.0.0.0 13831 64.0.0.0 11652 206.0.0.0 10295 204.0.0.0 10016 205.0.0.0 7795 218.0.0.0 6666 202.0.0.0

3 3

SLC Sheraton wireless
by Rodney Joffe 01 Jun '03

01 Jun '03

Is there a trick to the wireless connectivity in the hotel? Or limited coverage/blackholes?

2 1

WTF?? Was: AOL email concerns for pil.net (fwd)
by up＠3.am 01 Jun '03

01 Jun '03

I just received 2 copies of this email from AOL's Postmaster, and it looks genuine. We filter via SpamAssassin, but do not bounce spam or virii, but divert them to separate folders. The only strange activity I've seen lately is spammers getting past SA by sending spam to everything@customersdomain via their formmail.pl scripts. Note that they're not relaying via formmail.pl; we're using a hacked version of formmail.pl that only allows recipients of domains we host, which is where they're going. This could be unrelated, though. I sent back a reply requesting a copy of an offending bounce, one of the complaints, and for their postmaster to wrap his lines at something less than the 110 characters they're wrapping at now. I've never gotten a response from an AOL postmaster in the past...is there a better way of contacting them? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am ========================================================================= ---------- Forwarded message ---------- Return-Path: <> Delivered-To: james(a)richard2.pil.net Received: (qmail 70063 invoked by alias); 1 Jun 2003 13:22:43 -0000 Delivered-To: postmaster(a)pil.net Received: (qmail 70056 invoked by uid 85); 1 Jun 2003 13:22:43 -0000 Received: from by mail.pil.net by uid 82 with qmail-scanner-1.16 (spamassassin: 2.54. Clear:SA:0(2.3/6.0):. Processed in 1.494999 secs); 01 Jun 2003 13:22:43 -0000 X-Spam-Status: No, hits=2.3 required=6.0 Received: from unknown (HELO imo-m08.mx.aol.com) (64.12.136.163) by richard2.pil.net with SMTP; 1 Jun 2003 13:22:41 -0000 Received: from mailops.mail.aol.com (mailops.mail.aol.com [172.20.75.176]) by imo-m08.mx.aol.com (8.8.8/8.8.8/AOL-5.0.0) with ESMTP id JAA13696; Sun, 1 Jun 2003 09:22:38 -0400 (EDT) Received: (from root@localhost) by mailops.mail.aol.com (8.11.6+Sun/8.11.6) id h51DMbo06521; Sun, 1 Jun 2003 09:22:37 -0400 (EDT) Date: Sun, 1 Jun 2003 09:22:37 -0400 (EDT) Message-Id: <200306011322.h51DMbo06521(a)mailops.mail.aol.com> From: postmaster(a)aol.com Subject: AOL email concerns for pil.net Content-Type: text/html; charset=us-ascii X-Qmail-Scanner-1.16: added fake MIME-Version header MIME-Version: 1.0 Dear pil.net, You are receiving this message via our automated "Report Card" process (which helps analyze AOL's Internet inbound mail) because pil.net has risen above/below acceptable thresholds in one or more of these three categories: 1) Total percentage of messages bounced (exceeds 10% invalid email addresses in a 24 hour period): 0% 2) Total percentage of bounces accepted by pil.net (lower than 90% acceptance): 74% 3) Total number of AOL member complaints: 732 AOL takes proactive steps to contact owners of mail servers whose e-mail transmissions are impairing the functioning of AOL's proprietary e-mail system, or causing significant levels of AOL customer complaints. AOL requests that you take immediate steps to resolve the issues identified in this AOL Report Card. In the absence of a satisfactory resolution, AOL reserves the right to take measures to protect its email network and its member goodwill from any possible damage. These measures may include declining to accept e-mail transmissions from pil.net through AOL's proprietary e-mail network. AOL strives to provide the best online experience possible for our members, and we pride ourselves on being intensely focused on consumers and their needs. Email is a core feature of the AOL service, and the proper functioning of AOL's e-mail system is vital to our members' goodwill. Please review AOL's e-mail policies and guidelines, as well as other technical details concerning e-mail on the AOL network, at http://postmaster.info.aol.com AOL is eager for you to resolve these issues expeditiously, so we can continue to provide the best possible e-mail service to our members. Thank you for your prompt attention to this important matter.

2 1

IANA reserved Address Space
by Brennan_Murphy＠NAI.com 01 Jun '03

01 Jun '03

I'm tasked with coming up with an IP plan for an very large lab network. I want to maximize route table manageability and router/firewall log readability. I was thinking of building this lab with the following address space: 1.0.0.0 /8 10.0.0.0 /8 100.0.0.0 /8 I need 3 distinct zones which is why I wanted to separate them out. In any case, I was wondering about the status of the 1 /8 and the 100 /8 networks. What does it mean that they are IANA reserved? Reserved for what? http://www.iana.org/assignments/ipv4-address-space Anyone else ever use IANA reserved address spacing for lab networks? Is there anything special I need to know? I'm under the impression that as long as I stay away from special use address space, I've got no worries. http://www.rfc-editor.org/rfc/rfc3330.txt Thanks, BM

13 17

Re: Clocking Sources (was NTp sources that work in a datacenter (was Re: Is latency equivalentto RTT?))
by Peter Lothberg 01 Jun '03

01 Jun '03

> Quartz < Rubidium < Cesium. quartz < rubidium < cesium-beam < hydrogen < cesium-fontain -P

1 0

Re: NTp sources that work in a datacenter (was Re: Is latency equivalent to RTT?)
by Peter Lothberg 01 Jun '03

01 Jun '03

> > In message <Pine.LNX.4.44.0305140802170.7544-100000(a)twin.uoregon.edu>, Joel Jae > ggli writes: > > > > > >Also if you just need a high level of syncronization between the time on > >all your hosts you can just deploy one standalone ntp server, sync it > >against public time sources and get everything synced against that. its > >probably a 95% solution to most people's timeing needs. > > > > If I recall correctly, NTP assumes that latency = RTT/2. You might > make it work well for his application *if* you set up your tree so that > your paths are each one hop, or at least symmetric over your network. Correct, and if it's asymetric you get a static offset. My laptops internal clock is a bigger source of error... -P

1 0